Logout route not sending the access_token

[rickgoemans]

This week I've been doing updating our OAuth2 flow for the SPA with Laravel Passport since the password grant token is not recommended because you can't hide the client_secret.

For this reason we've decided to switch over to the "Authorization Code Grant with PKCE" (https://laravel.com/docs/9.x/passport#code-grant-pkce). We're using Nuxt with the auth module (https://auth.nuxtjs.org), which is configured as shown below:

auth: {
    plugins: [
        '~/plugins/auth.ts',
    ],
    redirect: {
        login: '/auth/login',
        logout: '/auth/logout-success',
        callback: '/auth/callback',
        home: '/dashboard',
    },
    strategies: {
        oauth2: {
            scheme: 'oauth2',
            endpoints: {
                authorization: `${process.env.AUTH_BASE_URL}authorize`,
                token: `${process.env.AUTH_BASE_URL}token`,
                logout: `${process.env.SPA_API_BASE_URL}auth/logout`,
                userInfo: `${process.env.SPA_API_BASE_URL}auth/me`,
            },
            responseType: 'code',
            grantType: 'authorization_code',
            accessType: 'offline',
            clientId: process.env.OAUTH_CLIENT_ID,
            scope: '*',
            codeChallengeMethod: 'S256',
        },
    },

What I find confusing is that the logout request that is being sent does not include the Authorization header (with Bearer ...). Does that mean that it's only supposed to go as a web route and therefore is stateful with a session and should logout the user's session that was set during the login phase to gather the code (oauth_auth_codes table in the database) which is needed to grab an access_token and refresh_token?

I assume the access_token and refresh_token have to be revoked to ensure somebody else could not use them if they could collect them somehow.

Another confusing/weird thing for me is that the session lifetime will probably be lower (by default 120 minutes in Laravel's config/session.php) than the token's lifetime (which is by default one year according to the docs (https://laravel.com/docs/9.x/passport#token-lifetimes) , resulting in the user already being logged out by exceeding the session limit while still having a valid access/refresh token.

Either I'm missing some crucial part or I've misconfigured something, but for me (with the current implementation), I'm worried and confused a lot.