google / google/googleapis.dart

Token Revocation

Open
#422 3 comments 0 reactions 0 assignees View on GitHub
Dominant language
Dart
Stars
419
Forks
136
Avg merge
1h 21m
Merged PRs (30d)
5

Description

This is a question more than a bug. It doesn't seem as though there is a way for a user to revoke an access token using googleapis_auth. I don't think this is a problem _per se_ because revoking tokens doesn't seem to be a typical procedure. However, my assumption was that any app that uses OAuth tokens should explicitly revoke them when the user signs out of the app. There is an [OAuth spec](https://oauth.net/2/token-revocation/) for this. Some [Google docs](https://cloud.google.com/apigee/docs/api-platform/security/oauth/enable-retrieval-and-revocation-oauth-20-access-tokens-end-user-id-app-id-or-both) seem to indicate that it's possible, but don't mention anything about best practices.

I'm just wondering if the dart APIs would benefit from code to revoke tokens...

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.