search

owncloud / oauth2

🔐 Application for using OAuth 2.0 in ownCloud
GNU Affero General Public License v3.0
32 stars 24 forks source link

API for clients to revoke access tokens #346

Open miwig opened 1 year ago

miwig commented 1 year ago

It seems that currently the only way to revoke an access token is through the settings page in the web UI. That sends a POST request to /apps/oauth2/clients/{id}/revoke, where {id} is just a database row ID for the client, see here. It seems there's no way to get the {id} for a given client, except for looking it up in the settings page and remembering it, or parsing the HTML, both of which seem brittle.

It would be useful if there was an API to revoke a token given nothing but that token, e.g. for a client application to revoke its own token from its own UI instead of sending users to the settings page.

michaelstingl commented 1 year ago

Did you consider using OpeID Connect with an external IdP? There you have much more control, than in the very limited OAuth 2.0 implementation for the ownCloud 10 server.