I am new to OAuth 2.0. I used BShaffer's OAuth PHP Server on Authorization Code Grant, and I understand that the client application can have its OAuth token separate from its session authentication, that is, if a user logs out, the access token is not revoked, and the refresh token is used to get new access token upon expiry.

I am building a trusted application using an API with OAuth User Credential (or Resource Owner) Grant. My questions are:

  1. Since I am in OAuth User Credential Grant, should OAuth hold all the user credentials and solely be the user authentication layer (which would act like an SSO layer)?
  2. With that, can I use an OAuth token as a session token?
  3. Upon logging out of the client application, should I revoke the OAuth token?
  • for pt. 1, do you mean to say that the OAuth authorisation server manage the user credentials as well?
    – bhorkarg
    Apr 5, 2020 at 15:17

1 Answer 1

  1. I don't understand what you mean with Oauth holding the user credentials. That should not happen. User credentials should only flow between the user and the authorization server.
  2. Yes.
  3. Yes. I think it is the expected behavior.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .