Q27: How does OAuth 2.0 Token Revocation (RFC 7009) operate?
Token Revocation defines a standardized HTTP API endpoint (/revoke) allowing client applications to explicitly inform the Authorization Server that a user has logged out or that a token is no longer needed.
When a client submits an Access Token or Refresh Token to /revoke, the Authorization Server invalidates the token and its associated token family across all cluster nodes.
Key Takeaways
- RFC 7009 provides a standard mechanism for explicit client-side logout token invalidation.
- Revoking a parent refresh token automatically revokes all associated child access tokens.