Closed nichtich closed 1 year ago
The following changes are required in specification and implementation:
patron
is not required anyway)Does anyone use OAuth Token Revocation at all? Public identify providers have implemented it differently anyway:
access_token
instead of token
Valid implementations exist nevertheless and full conformance to RFC 7009 would be nice but I doubt the endpoint will actually be used.
RFC 7009 defines a standard method for OAuth 2.0 token revocation. To align PAIA auth logout with this RFC 7009 it should become a Token Revoking Endpoint:
application/x-www-form-urlencoded
token
token_type_hint
(can be ignored)RFC 7009 does not forbid response body, such as the current JSON object with
patron
:The current
patron
request field can be made optional and should be ignored: in fact logout does not logout a patron but a token.For backwards-compatibility
token
parameter optional (although this does not strictly conform to RFC 7009) and just use the access token as provided with request parameteraccess_token
or HTTP request headerAuthorization
.PAIA auth could also support JSON request in addition toapplication/x-www-form-urlencoded
Example request