I agree token management is important. It actually can (and sometimes must) go farther than token deletion/revocation. For instance, adding the possibility for the resource owner (or others with appropriate rights) of "inspecting" released tokens etc. Kind of like what UMA is getting at.
At the protocol level we already have a request message to obtain a token, it would seem logical to have one to delete/revoke it. In our OAuth implementation we adopted a RESTful approach where tokens were represented as URIs. In that case token management (which ) is "just" a matter of using standard HTTP operations. However, there are security issues that needs to be dealt with in terms of who can perform such operation. This is especially the case with large deployments or when the OAuth protocol is only one part of a more complex product. All this to say that I don't think HTTP delete is the general solution for this and would advocate for a Delete_token request. Hubert On Fri, May 21, 2010 at 6:05 AM, Chasen Le Hara <[email protected]> wrote: > On Sun, May 16, 2010 at 11:27 AM, Dick Hardt <[email protected]> wrote: >> >> Torsten: enabling a client to revoke a refresh token looks like a useful >> mechanism. I anticipate it will be viewed as a vitamin feature rather than a >> painkiller and will fall by the wayside unless the security conscience rally >> to have it included. > > I’d like to put in another vote for this mechanism. > I’m about to add a “in-app logout” to an iPhone app that uses OAuth; while I > can delete the token from the device, a standard way for deleting the token > from the web service would be helpful in preventing future uses of the token > (for example, if the device is restored from a backup and the token was > stored in the backup files). > -Chasen > _______________________________________________ > OAuth mailing list > [email protected] > https://www.ietf.org/mailman/listinfo/oauth > > _______________________________________________ OAuth mailing list [email protected] https://www.ietf.org/mailman/listinfo/oauth
