[OAUTH-WG] in-app logout?

[Torsten Lodderstedt <[e-mail]>]

OAuth currently focues on the issuance and usage of tokens.

What about refresh token revocation/deletion?

Several mobile apps today use long-living tokens as a means to log in to 
services. They typically also offer a button to log-off/log-out, which 
cause the app to delete the token from the device. From my point of 
view, it would be beneficially if the client could also discard the 
refresh token at the authorization server. Otherwise the token is still 
valid, which might be intransparent to the user.

I propose to add another request "delete" (or cancel or logoff or 
logout) which allows the client to delete the refresh token (and the 
end-user authorization it represents) at the authorization server.

Parameters: client_id, client_secret (optional), refresh_token

The request must check whether the token has been issued to the calling 
client. Otherwise the request is refused.

Thoughts?

regards,
Torsten.