search

thephpleague / oauth2-client

Easy integration with OAuth 2.0 service providers.
http://oauth2-client.thephpleague.com
MIT License
3.63k stars 751 forks source link

Logout #1024

Open wellingtonoliveira96 opened 6 months ago

wellingtonoliveira96 commented 6 months ago

Hello,

It's my first time working with ouath and the oauth2-client. I couldn't find anything about user logout in the library docs.

I'm using the GenericProvider to connect using a work routes for authentication(there isn't a own provider). So in the docs of my work oauth guide they talk about a logout using a combination of:

url + token_hint + the return page. Where:

The url is the route of logout The token_hint is the token of the user, used to eliminate the requirement of logout confirmation by the user The return page is the page that will load in case of well succeded logout

I've tried some implementations but I didn't have success in the implementation.

ramsey commented 6 months ago

I don't believe OAuth itself defines any kind of logout functionality, which is why oauth2-client doesn't provide any logout mechanisms. Tokens either expire or they don't. If they do expire, OAuth provides a mechanism to refresh them, but not all providers implement token refresh.

If OAuth did define a logout, it would probably involve some manner of making a request to immediately invalidate the token so that it can't be reused on subsequent requests. Many services already provide this kind of functionality, but the user would need to log in to their account at the provider to revoke the tokens issued to other services. Most services (I've seen) do not provide token revocation through their APIs.

sjordan1975 commented 2 months ago

@ramsey Added as a point of discussion

I've just started implementing OAuth integration with the Calendly API and they do provide a token revoke endpoint in their API (see https://developer.calendly.com/api-docs/0c80c89b5e2e1-revoke-access-refresh-token).

Might revoke be up for consideration in the client library?

ShawnCZek commented 3 weeks ago

@sjordan1975: This has been discussed in the past; see #479.

However, I agree that it would be nice if the OAuth2 Client at least provided an interface for token revocation so the client libraries do not have to completely reimplement a new request type as I did for Discord (wohali/oauth2-discord-new#45).