Revoke Token : UserAuthorizer revokeAuthorization error

[blachot]

Hello,

UserAuthorizer.revokeAuthorization(String userId) method seems to contain an error
URL to revoke token is call with GET method instead POST :
HttpRequest tokenRequest = requestFactory.buildGetRequest(revokeUrl);
The service return an 404 error

Environment details

1. https://oauth2.googleapis.com/revoke
2. OS type and version:Windows, Linux
3. Java version:11
4. google-auth-library version(s): 1.2.2

Code example

        val userCredentials: UserCredentials = getGoogleApiCredentials(userAccount)
        val authorizer: UserAuthorizer = UserAuthorizer.newBuilder()
            .setClientId(ClientId.of(userCredentials.clientId, userCredentials.clientSecret))
            .setScopes(GmailConfig.GMAIL_SCOPE)
            .build()
        authorizer.storeCredentials(userAccount.userId, userCredentials)
        authorizer.revokeAuthorization(userAccount.userId)

Stack trace

Failed to revoke token for ck4CBxWMHUVnRUU0clImuG3Jmlt2
com.google.api.client.http.HttpResponseException: 404 Not Found
GET https://oauth2.googleapis.com/revoke?token=1//03EeIawv2OnUHCgYIARAAGAMSNwF-L9IrgKmtqRiSR5dTeUF_lgeuKXJ-cfA5eKhGfA6vpCUJ1MgxBJuhxGbk_WkYPQEs0gitNx4

[lesv]

I'm not an expert in auth, but if I were to guess, I would suspect that the scope you are using isn't enough.

• OpenID's discovery doc supports 3 scopes.
• Oauth2's says it also supports 3 scopes

That said, when I look at the example for raw html revocation it doesn't seem to need any kind of auth token, other than the one you wish to stop. Which would suggest your addition of authorizer might not be required.

[blachot]

Hello, According to the documentation, a token must be transmitted. https://developers.google.cn/identity/protocols/oauth2/web-server?hl=en#tokenrevoke But that's not the problem. Contrary to what is described in the documentation, the method UserAuthorizer.revokeAuthorization(String userId) present in the lib is called as GET instead of POST String revokeToken = (refreshToken != null) ? refreshToken : accessTokenValue; GenericUrl revokeUrl = new GenericUrl(OAuth2Utils.TOKEN_REVOKE_URI); revokeUrl.put("token", revokeToken); HttpRequestFactory requestFactory = transportFactory.create().createRequestFactory(); HttpRequest tokenRequest = requestFactory.*buildGetRequest*(revokeUrl); tokenRequest.execute(); It's seems better with something like this: String revokeToken = (refreshToken != null) ? refreshToken : accessTokenValue; GenericData genericData = new GenericData(); genericData.put("token", revokeToken); UrlEncodedContent content = new UrlEncodedContent(tokenRequest); HttpRequestFactory requestFactory = transportFactory.create().createRequestFactory(); HttpRequest tokenRequest = requestFactory.buildPostRequest(GenericUrl(OAuth2Utils.TOKEN_REVOKE_URI), content); tokenRequest.execute(); Regards. Le mer. 3 nov. 2021 à 02:37, Les Vogel ***@***.***> a écrit :

…

I'm not an expert in auth, but if I were to guess, I would suspect that the scope you are using isn't enough. - OpenID's discovery doc <https://developers.google.com/identity/protocols/oauth2/openid-connect> supports 3 scopes. - Oauth2's says it also supports 3 scopes <https://developers.google.com/identity/protocols/oauth2/scopes#oauth2> That said, when I look at the example for raw html revocation <https://developers.google.com/identity/protocols/oauth2/web-server#httprest_8> it doesn't seem to need any kind of auth token, other than the one you wish to stop. Which would suggest your addition of authorizer might not be required. — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub <#782 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AOABMMABYEGH2OLV4XYWELTUKCG4JANCNFSM5HGG35JA> . Triage notifications on the go with GitHub Mobile for iOS <https://apps.apple.com/app/apple-store/id1477376905?ct=notification-email&mt=8&pt=524675> or Android <https://play.google.com/store/apps/details?id=com.github.android&referrer=utm_campaign%3Dnotification-email%26utm_medium%3Demail%26utm_source%3Dgithub>.

-- Bruno Lachot

[TimurSadykov]

Will try to reproduce and update the status

[TimurSadykov]

ETA Jun 27

[TimurSadykov]

dropping priority until repro confirmed

[sai-sunder-s]

Fixed in #979