> Since refresh token is only issued to clients capable of directly interacting > with the authorization server, is there a reason why the endpoint cannot use > DELETE instead of a POST with a parameter? > > DELETE /token HTTP/1.1 > Host: server.example.com > Content-Type: application/x-www-form-urlencoded > > > grant_type=refresh_token&client_id=s6BhdRkqt3&client_secret=8eSEIpnqmM&refresh_token=n4E9O119d > > This looks like an elegant way of doing things. I'm not sure about using the > token endpoint for this, but that's a separate issue.
The DELETE method deletes the resource identified by the URI. I don't think it is usual to have any body with a DELETE. Any intermediaries seeing the DELETE will mark as stale any cached responses indexed by the URI -- they will not look in the body. In short, a more web-style approach is to give each token its own URI and DELETE that. DELETE /token?refresh_token=n4E90119d HTTP/1.1 Authorization: BASIC czZCaGRSa3F0Mzo4ZVNFSXBucW1N -- James Manger _______________________________________________ OAuth mailing list [email protected] https://www.ietf.org/mailman/listinfo/oauth
