Class: Hitch::RevocationsController

Inherits:
PublicEndpointController
  • Object
show all
Includes:
CorsSupport, OauthFormAdmission
Defined in:
app/controllers/hitch/revocations_controller.rb

Overview

POST /oauth/revoke — revoke an access token (RFC 7009). Per the RFC, returns 200 regardless of whether the token exists so callers can't probe for valid tokens.

Constant Summary

Constants included from RequestAdmission

Hitch::RequestAdmission::MAX_REQUEST_BODY_BYTES

Instance Method Summary collapse

Instance Method Details

#create ⇒ Object 



11
12
13
14
15
16
17
18
19
20
 
# File 'app/controllers/hitch/revocations_controller.rb', line 11

def create
  return head :ok unless request.media_type == Hitch::OauthRequestParameters::FORM_MEDIA_TYPE

  token_value = oauth_parameters(:token, form_only: true)[:token]
  revoke(token_value) if token_value.present?

  head :ok
rescue Hitch::OauthRequestParameters::Invalid
  head :ok
end