Re: [OAUTH-WG] in-app logout?

"Manger, James H" <James.H.Manger@team.telstra.com> Tue, 15 June 2010 04:24 UTC

From: "Manger, James H" <James.H.Manger@team.telstra.com>
To: Eran Hammer-Lahav <eran@hueniverse.com>
Date: Tue, 15 Jun 2010 14:24:01 +1000
Thread-Topic: [OAUTH-WG] in-app logout?
Thread-Index: AcsL76dIklVHVQb3TtKjiBr3sg/bNAAFB3hAAA8T1QA=
Message-ID: <255B9BB34FB7D647A506DC292726F6E112640B7698@WSMSG3153V.srv.dir.telstra.com>
References: <4BEBDCFB.7090503@lodderstedt.net> <255B9BB34FB7D647A506DC292726F6E11263465727@WSMSG3153V.srv.dir.telstra.com> <AANLkTikxD3jraqvG2IFmaSme0f1Q7NGPuQ3llqX3Ds5W@mail.gmail.com> <AANLkTil8c6oLx-YpyQ57seoFpuZQ013hLpVWfdb8JWlM@mail.gmail.com> <AANLkTilx7NPXa_XGSHmXw4vtLIlCQFf3DfcagP84TTtJ@mail.gmail.com> <AANLkTilOpF2iTB0LKGjQCGp8hMyL38SwtjrwgWsUi5zf@mail.gmail.com> <4BFD67CA.5040600@lodderstedt.net> <90C41DD21FB7C64BB94121FBBC2E72343B3EBB66F0@P3PW5EX1MB01.EX1.SECURESERVER.NET> <4C16753A.9050802@lodderstedt.net> <90C41DD21FB7C64BB94121FBBC2E72343B3EBB680C@P3PW5EX1MB01.EX1.SECURESERVER.NET>
In-Reply-To: <90C41DD21FB7C64BB94121FBBC2E72343B3EBB680C@P3PW5EX1MB01.EX1.SECURESERVER.NET>
Accept-Language: en-US, en-AU
Content-Language: en-US
acceptlanguage: en-US, en-AU
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: base64
MIME-Version: 1.0
Cc: "OAuth WG (oauth@ietf.org)" <oauth@ietf.org>
Subject: Re: [OAUTH-WG] in-app logout?
Precedence: list

> Since refresh token is only issued to clients capable of directly interacting with the authorization server, is there a reason why the endpoint cannot use DELETE instead of a POST with a parameter?
>
>  DELETE /token HTTP/1.1
>  Host: server.example.com
>  Content-Type: application/x-www-form-urlencoded
>  
>  grant_type=refresh_token&client_id=s6BhdRkqt3&client_secret=8eSEIpnqmM&refresh_token=n4E9O119d
>
> This looks like an elegant way of doing things. I'm not sure about using the token endpoint for this, but that's a separate issue.


The DELETE method deletes the resource identified by the URI. I don't think it is usual to have any body with a DELETE. Any intermediaries seeing the DELETE will mark as stale any cached responses indexed by the URI -- they will not look in the body.

In short, a more web-style approach is to give each token its own URI and DELETE that.

  DELETE /token?refresh_token=n4E90119d HTTP/1.1
  Authorization: BASIC czZCaGRSa3F0Mzo4ZVNFSXBucW1N

--
James Manger

[OAUTH-WG] in-app logout? Torsten Lodderstedt
Re: [OAUTH-WG] in-app logout? Manger, James H
Re: [OAUTH-WG] in-app logout? Manger, James H
Re: [OAUTH-WG] in-app logout? Dick Hardt
Re: [OAUTH-WG] in-app logout? Dick Hardt
Re: [OAUTH-WG] in-app logout? Yaron Goland
Re: [OAUTH-WG] in-app logout? Manger, James H
Re: [OAUTH-WG] in-app logout? Manger, James H
Re: [OAUTH-WG] in-app logout? Hubert Le Van Gong
Re: [OAUTH-WG] in-app logout? Lukas Rosenstock
Re: [OAUTH-WG] in-app logout? Chasen Le Hara
Re: [OAUTH-WG] in-app logout? Allen Tom
Re: [OAUTH-WG] in-app logout? Beau Lebens
Re: [OAUTH-WG] in-app logout? Hubert Le Van Gong
Re: [OAUTH-WG] in-app logout? Torsten Lodderstedt
Re: [OAUTH-WG] in-app logout? Igor Faynberg
[OAUTH-WG] Fwd: Re: in-app logout? Torsten Lodderstedt
Re: [OAUTH-WG] in-app logout? Eran Hammer-Lahav
Re: [OAUTH-WG] Fwd: Re: in-app logout? Justin Richer
Re: [OAUTH-WG] Fwd: Re: in-app logout? George Fletcher
Re: [OAUTH-WG] in-app logout? Eran Hammer-Lahav
Re: [OAUTH-WG] in-app logout? Torsten Lodderstedt
Re: [OAUTH-WG] in-app logout? Eran Hammer-Lahav
Re: [OAUTH-WG] in-app logout? Manger, James H
Re: [OAUTH-WG] in-app logout? Justin Richer