cannot "log out" with a read-only token
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 8.7k
- Forks
- 4.8k
- Avg merge
- 4d 10h
- Merged PRs (30d)
- 53
Description
- Request an OAuth token with scope
user:info user:list-projects - Use the token in the cli (
oc login --token=<token>) - Attempt to log out (
oc logout)
The log out attempts to delete the token, and is forbidden, so the token remains valid against the API
I'm not sure whether this is the behavior we want or not, but it was a little unexpected. We should decide whether we want to issue tokens that cannot be revoked by the bearer.
cc @deads2k
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing the OAuth flow with the user:info user:list-projects scopes, using oc login --token=<token> followed by oc logout. Trace the oc login and oc logout entry points to understand the token deletion behavior. Done requires a decided revocation policy and behavior that matches it, with coverage for read-only tokens.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- authentication, cli, security
- Issue type
- Bug
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100