Passing revoked refresh token is not breaking the flow

[#1]

Hi,

I have created a proxy to revoke access and refresh token. When I am passing the revoked access_token again to revoke, I have GetOAuthV2Info policy in flow which is throwing 'The access token has been revoked' error(I hope that's exacted behavior)

but while passing revoked refresh_token the GetOAuthV2Info policy is not throwing any error and I am able to get the info of revoked refresh_token. Although that refresh_token is already revoked as I am not able to generate the access_token using that refresh_token

Is this the expected behavior of GetOAuthV2Info policy in case of revoked refresh_token?

<GetOAuthV2Info name="GetOauthRefreshTokenID">

<RefreshToken ref="requestToken"></RefreshToken>

</GetOAuthV2Info>

[markeccles-1]

Hi @Abhishek Tiwari,

This is the intended behavior. Note that the access token and refresh token will still remain in Cassandra for some time even after they have been revoked. The important thing is that the refresh_token_status field is 'revoked' for this refresh token that you have revoked.

[#3]

Thanks Mark. 🙂