+1 There are many examples in production of token authentication schemes that have a ³revoke token² API for clients to voluntarily revoke their own credentials.
Examples: Google¹s AuthSubRevokeToken: http://code.google.com/apis/accounts/docs/AuthSub.html#AuthSubRevokeToken OAuth Session Extension (for OAuth 1.0a): http://oauth.googlecode.com/svn/spec/ext/session/1.0/drafts/1/spec.html#anch or10 Allen On 5/20/10 9:05 PM, "Chasen Le Hara" <[email protected]> wrote: > On Sun, May 16, 2010 at 11:27 AM, Dick Hardt <[email protected]> wrote: >> Torsten: enabling a client to revoke a refresh token looks like a useful >> mechanism. I anticipate it will be viewed as a vitamin feature rather than a >> painkiller and will fall by the wayside unless the security conscience rally >> to have it included. > > I¹d like to put in another vote for this mechanism. > > I¹m about to add a ³in-app logout² to an iPhone app that uses OAuth; while I > can delete the token from the device, a standard way for deleting the token > from the web service would be helpful in preventing future uses of the token > (for example, if the device is restored from a backup and the token was stored > in the backup files). > -Chasen > > > _______________________________________________ > OAuth mailing list > [email protected] > https://www.ietf.org/mailman/listinfo/oauth
_______________________________________________ OAuth mailing list [email protected] https://www.ietf.org/mailman/listinfo/oauth
