Revoking Access to Client?

[lonnieezell]

I'm trying to provide clients the ability to revoke the authorization token for the application so that they would have to go through the login process again. Is there a way to do so with this library? I can't find one.

For example, with Facebook we'd have to send an HTTP DELETE request to /PROFILE_ID/permissions.

[shadowhand]

That's entirely up to the provider you are authorizing against. This library only provides an abstraction of the standard OAuth2 spec, which does not include any standard for revoking tokens outside of normal expiration.

[lonnieezell]

Bummer. Thanks for the response. Would be a nice addition to simple have a 'revoke()' method in the AbstractProvider so other providers can implement, though.

[stevenmaguire]

You could also use the getAuthenticatedRequest.

$request = $provider->getAuthenticatedRequest(
    'DELETE',
    '/PROFILE_ID/permissions',
    $accessToken
);

[ramsey]

Since it's non-standard, I don't think a revoke() method on the AbstractProvider is necessary. However, you might propose that the league/oauth2-facebook provider add a revoke() method that does exactly what @stevenmaguire suggests. :-)