venveo / craft-oauthclient

A free to use OAuth 2.0 Client helper for Craft 3 developers
MIT License
9 stars 3 forks source link

When Resource Server withdraws AccessToken renderConnector() doesn't know and users can't authorize again #39

Open bencresty opened 3 years ago

bencresty commented 3 years ago

When using renderConnector() the template only checks if there is a known token (and perhaps if it is expired according to the date, not sure). But when the Resource Server withdraws the AccessToken the plugin doesn't know about it and renderConnector() doesn't check if the token is still valid. Not with a page refresh either, as it's still only checking if there is a token known, and that's still the case, although that token isn't valid anymore.

Unfortunately because of this when using the renderConnector() function it isn't possible for users to reconnect either. So even if they know the connection is gone, the frontend will on each page refresh keep saying that there is a connection, eventhough it's long gone, and for the user there's no way to re-login.

Also I didn't come accross any method to remove a token. So even if we request data, get a response code indicating that the token is invalid, there seem to be no way to remove the token and let the user login again.