Re: [OAUTH-WG] in-app logout?

I agree token management is important. It actually can (and sometimes
must) go farther than token deletion/revocation. For instance, adding the
possibility for the resource owner (or others with appropriate rights) of
"inspecting" released tokens etc. Kind of like what UMA is getting at.

At the protocol level we already have a request message to obtain a
token, it would seem logical to have one to delete/revoke it.

In our OAuth implementation we adopted a RESTful approach where
tokens were represented as URIs. In that case token management
(which ) is "just" a matter of using standard HTTP operations. However,
there are security issues that needs to be dealt with in terms of who
can perform such operation. This is especially the case with large
deployments or when the OAuth protocol is only one part of a more
complex product.
All this to say that I don't think HTTP delete is the general solution
for this and would advocate for a Delete_token request.

Hubert

On Fri, May 21, 2010 at 6:05 AM, Chasen Le Hara <chasen@ironmoney.com> wrote:
> On Sun, May 16, 2010 at 11:27 AM, Dick Hardt <dick.hardt@gmail.com> wrote:
>>
>> Torsten: enabling a client to revoke a refresh token looks like a useful
>> mechanism. I anticipate it will be viewed as a vitamin feature rather than a
>> painkiller and will fall by the wayside unless the security conscience rally
>> to have it included.
>
> I’d like to put in another vote for this mechanism.
> I’m about to add a “in-app logout” to an iPhone app that uses OAuth; while I
> can delete the token from the device, a standard way for deleting the token
> from the web service would be helpful in preventing future uses of the token
> (for example, if the device is restored from a backup and the token was
> stored in the backup files).
> -Chasen
> _______________________________________________
> OAuth mailing list
> OAuth@ietf.org
> https://www.ietf.org/mailman/listinfo/oauth
>
>