Class: StandardId::Api::Oauth::RevocationsController

Inherits:
BaseController show all
Defined in:
app/controllers/standard_id/api/oauth/revocations_controller.rb

Constant Summary collapse

VALID_REVOCATION_SCOPES = 
%i[account grant].freeze
REVOCATION_REASON =

Carried on every SESSION_REVOKED event this endpoint causes.

"token_revocation".freeze

Constants included from RateLimitHandling

RateLimitHandling::DEFAULT_RETRY_AFTER, RateLimitHandling::RATE_LIMIT_STORE

Instance Method Summary collapse

Methods included from RateLimitHandling

login_per_email, login_per_ip, resolve_login_alias

Methods included from ControllerPolicy

all_controllers, authenticated_controllers, public_controllers, register, registry_snapshot, reset_registry!

Instance Method Details

#create ⇒ Object

POST /oauth/revoke RFC 7009 - OAuth 2.0 Token Revocation

Accepts a token and optional token_type_hint parameter. Always responds with 200 OK regardless of whether the token was valid or revocation was successful (per RFC 7009 Section 2.1).

How much gets revoked is controlled by config.oauth.revocation_scope (:account — historical, revoke every active DeviceSession for the subject; :grant — revoke only the authorization grant the presented token belongs to). See the schema comment on that field.



26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
 
# File 'app/controllers/standard_id/api/oauth/revocations_controller.rb', line 26

def create
  token = params[:token]
  head :ok and return if token.blank?

  payload = StandardId::JwtService.decode(token)
  head :ok and return unless payload&.dig(:sub)

  if revocation_scope == :grant
    revoke_presented_grant!(payload)
  else
    (payload[:sub])
  end

  head :ok
end