consent: Revokes consent sessions of a subject for a specific OAuth 2.0 Client safely #1951
Comments
5 tasks
aeneasr
pushed a commit
that referenced
this issue
Jul 31, 2020
…ed (#1952) This patch adds query parameter `all` to `/oauth2/auth/sessions/consent`. If `all=true`, then all consent sessions of a certain subject will be revoked. BREAKING CHANGE: Previously, '/oauth2/auth/sessions/consent?subject=foo@bar.com' would revoke all consent sessions of that user. This may be problematic in cases where the caller forgot to specify the client ID as all tokens for that user are revoked. To prevent that, a "failsave" `all=true` is now required to make this explicit: '/oauth2/auth/sessions/consent?subject=foo@bar.com&all=true'. Closes #1951
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Is your feature request related to a problem? Please describe.
About
DELETE /oauth2/auth/sessions/consenthttps://www.ory.sh/hydra/docs/reference/api/#revokes-consent-sessions-of-a-subject-for-a-specific-oauth-20-client
A consent session revocation API is capable for a specific OAuth 2.0 Client or all clients.
I feel scare because all consent sessions of a subject will be revoked if
clientURL parameter is forgotten or typo.Describe the solution you'd like
It should revoke all consent sessions of a subject only if it's requested explicitly.
Then I propose 2 ideas
clientparameter's value isall, revokes itDELETE /oauth2/auth/sessions/consent/all?subject=stringThe text was updated successfully, but these errors were encountered: