1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
|
Token Endpoints
===============
Django OAuth 2.0 authorization server has a method to register other token
endpoints: ``authorization_server.register_endpoint``. Available endpoints
for now:
1. Revocation Endpoint from RFC7009
2. Introspection Endpoint from RFC7662
Revocation Endpoint
-------------------
The revocation endpoint for OAuth authorization servers allows clients to
notify the authorization server that a previously obtained refresh or access
token is no longer needed.
This allows the authorization server to clean up security credentials.
A revocation request will invalidate the actual token and, if applicable, other
tokens based on the same authorization grant.
For example, a client may request the revocation of a refresh token
with the following request:
.. code-block:: http
POST /oauth/revoke HTTP/1.1
Host: server.example.com
Content-Type: application/x-www-form-urlencoded
Authorization: Basic czZCaGRSa3F0MzpnWDFmQmF0M2JW
token=45ghiukldjahdnhzdauz&token_type_hint=refresh_token
In Authlib Django OAuth 2.0 provider, we can simply add this feature::
from authlib.integrations.django_oauth2 import RevocationEndpoint
from django.views.decorators.http import require_http_methods
# see Authorization Server chapter
server.register_endpoint(RevocationEndpoint)
@require_http_methods(["POST"])
def revoke_token(request):
return server.create_endpoint_response(RevocationEndpoint.ENDPOINT_NAME, request)
That's all we need. Add this ``revoke_token`` to your routes to enable it. The suggested
url path is ``/oauth/revoke``.
Introspection Endpoint
----------------------
Check :ref:`register_introspection_endpoint` to get more details.
|
