google / google/googleapis.dart
Token Revocation
- Dominant language
- Dart
- Stars
- 419
- Forks
- 136
- Avg merge
- 1h 21m
- Merged PRs (30d)
- 5
Description
This is a question more than a bug. It doesn't seem as though there is a way for a user to revoke an access token using googleapis_auth. I don't think this is a problem _per se_ because revoking tokens doesn't seem to be a typical procedure. However, my assumption was that any app that uses OAuth tokens should explicitly revoke them when the user signs out of the app. There is an [OAuth spec](https://oauth.net/2/token-revocation/) for this. Some [Google docs](https://cloud.google.com/apigee/docs/api-platform/security/oauth/enable-retrieval-and-revocation-oauth-20-access-tokens-end-user-id-app-id-or-both) seem to indicate that it's possible, but don't mention anything about best practices.
I'm just wondering if the dart APIs would benefit from code to revoke tokens...
Contributor guide
Assessment
This issue has not been assessed yet.