Revoke Refresh Token on Logout

[devzeze]

Checklist

• I have looked into the Readme, Examples, and FAQ and have not found a suitable solution or answer.
• I have looked into the API documentation and have not found a suitable solution or answer.
• I have searched the issues and have not found a suitable solution or answer.
• I have searched the Auth0 Community forums and have not found a suitable solution or answer.
• I agree to the terms within the Auth0 Code of Conduct.

Describe the problem you'd like to have solved

There is a request for this feature in Auth0 Community but since this can be a security issue I think it should be discussed here also.

https://community.auth0.com/t/revoke-refresh-token-on-logout/80698

As it is stated:
This leaves it available for use if it is compromised on the client-side or in transit. The revoke refresh token endpoint can be called, separately, but it would be good to remove the refresh token for the device on logout.

Describe the ideal solution

Refresh token is revoked during logout.

Alternatives and current workarounds

We can call the endpoint to revoke the refresh token directly but this is a big limitation of the SDK and can lead to security issues since many users might not implement it.

https://auth0.com/docs/secure/tokens/refresh-tokens/revoke-refresh-tokens

Additional context

No response

[devzeze]

This makes even more sense since it is already supported on iOS.

https://auth0.github.io/Auth0.swift/documentation/auth0/credentialsmanager/
auth0/Auth0.swift#312

[func revoke(headers: [String : String]) async throws] Calls the /oauth/revoke endpoint to revoke the refresh token and then clears the credentials if the request was successful. Otherwise, the credentials are not cleared and an error is thrown.

[devzeze]

Noticed now this can be done with a different class:

AuthenticationAPIClient

https://github.com/auth0/Auth0.Android/blob/main/auth0/src/main/java/com/auth0/android/authentication/AuthenticationAPIClient.kt

/**
 * Request the revoke of a given refresh_token. Once revoked, the refresh_token cannot be used to obtain new tokens.
 * Your Auth0 Application Type should be set to 'Native' and Token Endpoint Authentication Method must be set to 'None'.
 *
 * Example usage:
 *
 * ```
 * client.revokeToken("{refresh_token}")
 *     .start(object: Callback<Void?, AuthenticationException> {
 *         override fun onSuccess(result: Void?) { }
 *         override fun onFailure(error: AuthenticationException) { }
 * })
 * ```
 *
 * @param refreshToken the token to revoke
 * @return a request to start
 */
public fun revokeToken(refreshToken: String)