parse-community / parse-community/parse-server

Revoke Access Token for Sign In with Apple

Open
#8,065 7 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

type:feature
Dominant language
JavaScript
Stars
21.4k
Forks
4.8k
Avg merge
7h 45m
Merged PRs (30d)
11

Description

New Feature / Enhancement Checklist
Current Limitation

When deleting an account Apple required to revoke Sign-In with Apple access tokens by 30 June 2022 (https://developer.apple.com/support/offering-account-deletion-in-your-app), currently it is not supported using Parse-Server.

Feature / Enhancement Description

Should have the option to revoke a user's Sign-In with Apple access token.

Example Use Case

Should have the option to call a revoke Sign-In with Apple access token for the specific user from cloud code. I guess it should use the client secret (which the developer shall create separately) and the authData from users table.

Alternatives / Workarounds

Could code a dedicated cloud code function for this using REST API, but everyone support this feature would need to duplicate this.
UPDATE: Apparently this cannot be done as it seems that the refresh token (which needed to be revoked) is stored somewhere on parse server and is not easily accessible. So, As I see it there should be internal support within Parse-Server.

3rd Party References

The formal reference: https://developer.apple.com/documentation/sign_in_with_apple/revoke_tokens

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by tracing Sign in with Apple authData for users and the cloud code entry point, then read Apple's revoke_tokens reference. Check how the refresh token is stored and how a developer-provided client secret would be used. Done means Parse Server supports revoking the specific user's Apple access token without each project duplicating a REST integration.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript, node.js
Domain
authentication, backend
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.