Skip to content

Revoke the access token before completing sign out #1

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
brionmario wants to merge 1 commit into from
Closed

Revoke the access token before completing sign out #1

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 13 additions & 0 deletions packages/browser/src/ThunderIDBrowserClient.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -369,6 +369,19 @@ class ThunderIDBrowserClient<T = BrowserAuthConfig> extends ThunderIDJavaScriptC
const sm = this.getStorageManager();
const config = await (sm as any).getConfigData();

// Revoke the access token at the OP before ending the session. Best-effort: revocation can
// fail (no revocation_endpoint advertised, network error, non-200 response) without blocking
// sign out, since the local session must be cleared regardless. Set
// tokenLifecycle.revokeToken.revokeOnSignOut to false to skip this and only clear the local
// session.
if (config?.tokenLifecycle?.revokeToken?.revokeOnSignOut !== false) {
try {
await this.revokeAccessToken(sessionId);
} catch (error) {
logger.debug('Could not revoke the access token before signing out.', error);
}
}

// OIDC RP-Initiated Logout: end the session at the OP's end_session_endpoint. The sign-out URL
// (carrying id_token_hint/client_id + post_logout_redirect_uri) is resolved before the local
// session is cleared, so the ID token used for the hint is still available. This is the default;
Expand Down
23 changes: 20 additions & 3 deletions packages/javascript/src/models/config.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -214,8 +214,8 @@ export interface BaseConfig<T = unknown> extends WithPreferences, WithExtensions
* by default derived by concatenating `baseUrl` with a fixed path (e.g. `{baseUrl}/flow/execute`).
* These do not participate in OIDC discovery.
*
* Split these two groups when the OAuth authorization server (IdP) and the Thunder resource
* server are different hosts — for example, when two Thunder instances are connected as trusted
* Split these two groups when the OAuth authorization server (IdP) and the ThunderID resource
* server are different hosts — for example, when two ThunderID instances are connected as trusted
* issuers. Point `baseUrl` (and hence the OAuth/discovery endpoints) at the authorization server,
* and override the resource-server endpoints to target the resource server that actually owns the
* users and flows.
Expand Down Expand Up @@ -429,6 +429,24 @@ export interface BaseConfig<T = unknown> extends WithPreferences, WithExtensions
*/
autoRefresh?: boolean;
};

/**
* Configuration for token revocation behavior.
*/
revokeToken?: {
/**
* Whether `signOut()` revokes the access token at the OP's `revocation_endpoint` before
* clearing the local session and completing sign out.
*
* Enabled by default. Revocation is best-effort: if it fails (no `revocation_endpoint`
* advertised, network error, non-200 response), sign out still proceeds with a
* local-only session clear. Set to `false` to skip revocation and only clear the local
* session.
*
* @default true
*/
revokeOnSignOut?: boolean;
};
};

/**
Expand Down Expand Up @@ -602,7 +620,6 @@ export interface Preferences {
i18n?: I18nPreferences;
/**
* Whether to resolve the theme from the Flow Meta API (GET /flow/meta).
* @remarks This is only applicable when using platform `ThunderID V2` (Thunder).
*/
resolveFromMeta?: boolean;
/**
Expand Down
Loading