Revoke API not working

Questions OAuth/OIDC
1

We are using revoke api as we want to invalidate access token, on revoke api call, we are getting status code with 200 status, but still that token on verify, shows its valid.

2

Are you using the /introspect endpoint to validate the token, or are you locally validating it? Local token validation will never take into consideration the state of the token on the server itself. You can only check if a token has been revoked (using the revocation endpoint) by sending it back to the introspection endpoint.

This is also mentioned in our guide about how to Validate Access Tokens.

3

I have tried using introspect endpoint. but its always giving status code 200 with active state false

…com/oauth2/v1/introspect

image
image

4

So after revoking, the introspect endpoint reports that the token is "active": false? This is expected/the desired behavior. The introspect endpoint will reflect the status of the token on the authorization server side, so when you make your /v1/revoke request, you toggled the status of the token from "active":true to "active":false

5

No, Even before i make call to revoke API, its giving status “active”:false

6

What’s the value of the iss claim in your token and does it match the /revoke URL you are using? You want to make sure you make the revocation call to the same authorization server, aka iss/v1/revoke

7

https://dev-45144393.okta.com/oauth2/v1/introspect
https://dev-45144393.okta.com/oauth2/v1/revoke

{
ver: 1,
jti: ‘AT.SF4NwZkvomCNB4oy0Dl3ZzijXy0gfHvs_ZbcZONY-OM’,
iss: ‘https://dev-45144393.okta.com/oauth2/default’,
aud: ‘api://default’,
iat: 1659593366,
exp: 1659596966,
cid: ‘0oahclrvabTRx8ohK6r3’,
uid: ‘00ufzb7ilbgqDmEKk2p7’,
scp: [ ‘openid’, ‘profile’, ‘email’ ],
auth_time: 1659589604,
sub: ‘manoj@yopmail.com’
}

This is claim, and url above, which i am using, and really i am getting false status for active token, before and after revoke

8

Based on the iss in the token payload you’ve shared, you should be using the following endpoints instead:
https://dev-45144393.okta.com/oauth2/default/v1/introspect
https://dev-45144393.okta.com/oauth2/default/v1/revoke

9

Thank you so much @andrea , Its working as expected. Great thanks

1 Like
10

This topic was automatically closed 24 hours after the last reply. New replies are no longer allowed.