Re: [OAUTH-WG] in-app logout?

+1

There are many examples in production of token authentication schemes that
have a ³revoke token² API for clients to voluntarily revoke their own
credentials.  

Examples:

Google¹s AuthSubRevokeToken:
http://code.google.com/apis/accounts/docs/AuthSub.html#AuthSubRevokeToken

OAuth Session Extension (for OAuth 1.0a):
http://oauth.googlecode.com/svn/spec/ext/session/1.0/drafts/1/spec.html#anch
or10

Allen

On 5/20/10 9:05 PM, "Chasen Le Hara" <chasen@ironmoney.com> wrote:

> On Sun, May 16, 2010 at 11:27 AM, Dick Hardt <dick.hardt@gmail.com> wrote:
>> Torsten: enabling a client to revoke a refresh token looks like a useful
>> mechanism. I anticipate it will be viewed as a vitamin feature rather than a
>> painkiller and will fall by the wayside unless the security conscience rally
>> to have it included.
> 
> I¹d like to put in another vote for this mechanism.
> 
> I¹m about to add a ³in-app logout² to an iPhone app that uses OAuth; while I
> can delete the token from the device, a standard way for deleting the token
> from the web service would be helpful in preventing future uses of the token
> (for example, if the device is restored from a backup and the token was stored
> in the backup files).
> -Chasen
> 
> 
> _______________________________________________
> OAuth mailing list
> OAuth@ietf.org
> https://www.ietf.org/mailman/listinfo/oauth