Using OAuth2 with JWT, should a client pass along unused refresh tokens on a logout call?

Question

I have a system with an OAuth2 authorization server. It hands out JWT access tokens and refresh tokens (the latter only to the mobile app client).

We don't persist access tokens (as is normal with JWT) but we do persist the (hashed) refresh tokens together with some meta data to be able to revoke them so that users can log out other devices. We also only allow a single use for refresh tokens, the new request also gives back a new refresh token.

The OAuth2 login server itself uses regular basic auth with sessions. The user wants to be able to logout (single devices/clients) here. So of course I have to invalidate the session itself. But ideally I want to remove the refresh token that this client still has as well. The problem is that I don't know that refresh token. A particular user could in theory have request multiple of them with their code request. The refresh token is also not normally passed in requests (only the access token)

Should I ask the clients (which are currently all under our own development) to send along their unused refresh tokens? Even if they 'forget' their refresh tokens locally, it still seems better if I also delete them on the server so they don't linger around until their expiry time. Note I do know all the refresh tokens currently in use for a certain account but I don't want to just delete them all because that would mean all devices are logged out. We also save some user agent-like info with the refresh tokens so users can use that to manually logout other devices, but it seems like a bad idea to try to perform string matching on those to automate that process.

Answer 1

I would suggest alternative - that I encountered in one OAuth server implementation.

Instead of requiring clients to provide all refresh tokens for invalidation simply store logout record for some time.

The logout record would contain user identification, client identification and logout timestamp.

Your server do not need to know all invalid tokens, because it can assume that any presented token - that was issued before last logout - is invalid.

You need only one logout record for user-client pair - as later logout would also invalidate earlier tokens. You also need to store it no longer than the longest token time to live.