OAuth2 Token Revocation — RFC 7009 Token Revocation for Access and Refresh Tokens

from flask import Flask, request, jsonify
from datetime import datetime, timezone

app = Flask(__name__)

@app.route('/revoke', methods=['POST'])
def revoke_token():
    """RFC 7009 token revocation endpoint."""
    token = request.form.get('token')
    token_type_hint = request.form.get('token_type_hint', 'access_token')
    client_id = authenticate_client(request)

    if not token:
        return jsonify({'error': 'invalid_request'}), 400

    # Attempt revocation regardless of which client owns the token
    # RFC 7009: always return 200 to prevent token enumeration
    revoke_access_token(token, client_id)

    if token_type_hint == 'refresh_token':
        revoke_refresh_token(token, client_id)

    # Always return 200 OK per spec
    return jsonify({'result': 'ok'}), 200

def revoke_access_token(token, requesting_client):
    """Revoke an access token."""
    token_data = find_access_token(token)
    if not token_data:
        return  # Token unknown — silently ignore

    # Validate client is authorized to revoke
    # The token owner or the authorization server can always revoke
    if not can_revoke(token_data, requesting_client):
        return

    # Revoke the token
    if token_data['type'] == 'jwt':
        # JWT tokens: add to blacklist until expiry
        blacklist_token(token, token_data['exp'])
    else:
        # Opaque tokens: delete or mark as revoked
        mark_token_revoked(token)

    # Log revocation
    log_revocation({
        'token_hash': hash_token(token),
        'client_id': requesting_client,
        'token_owner': token_data.get('user_id'),
        'timestamp': datetime.now(timezone.utc).isoformat(),
        'reason': 'user_initiated'
    })

import requests

class OAuth2Client:
    def __init__(self, client_id, client_secret, auth_url):
        self.client_id = client_id
        self.client_secret = client_secret
        self.auth_url = auth_url

    def revoke_token(self, token, token_type_hint='access_token'):
        """Revoke a token at the authorization server."""
        response = requests.post(
            f'{self.auth_url}/revoke',
            data={
                'token': token,
                'token_type_hint': token_type_hint,
                'client_id': self.client_id,
                'client_secret': self.client_secret
            }
        )

        if response.status_code == 200:
            print(f"Token revoked successfully")
            # Clear local storage
            self.clear_local_tokens()
        else:
            print(f"Revocation failed: {response.status_code}")
        return response.status_code == 200

    def logout(self):
        """Full logout: revoke both access and refresh tokens."""
        self.revoke_token(self.access_token, 'access_token')
        self.revoke_token(self.refresh_token, 'refresh_token')
        self.access_token = None
        self.refresh_token = None
        print("Logged out — all tokens revoked")

# User logout
client = OAuth2Client(CLIENT_ID, CLIENT_SECRET, 'https://auth.dodatech.com')
client.logout()

import redis
import json

class DistributedRevocation:
    def __init__(self, redis_client):
        self.redis = redis_client
        self.revocation_channel = 'token:revocations'

    def publish_revocation(self, token_hash, expires_at):
        """Publish revocation event to all subscribers."""
        event = {
            'token_hash': token_hash,
            'expires_at': expires_at.isoformat(),
            'published_at': datetime.now(timezone.utc).isoformat()
        }
        self.redis.publish(self.revocation_channel, json.dumps(event))
        print(f"Published revocation for token hash: {token_hash[:16]}...")

    def subscribe_and_blacklist(self):
        """Subscribe to revocation events and update local blacklist."""
        pubsub = self.redis.pubsub()
        pubsub.subscribe(self.revocation_channel)

        for message in pubsub.listen():
            if message['type'] != 'message':
                continue

            event = json.loads(message['data'])
            token_hash = event['token_hash']
            expires_at = datetime.fromisoformat(event['expires_at'])

            # Add to local blacklist with TTL matching token expiry
            blacklist_key = f"blacklist:{token_hash}"
            self.redis.setex(blacklist_key, expires_at, 'revoked')
            print(f"Blacklisted token {token_hash[:16]}... until {expires_at}")

    def is_revoked(self, token_hash):
        """Check if a token is in the distributed blacklist."""
        return self.redis.exists(f"blacklist:{token_hash}")

# Usage on each resource server
revoker = DistributedRevocation(redis_client)
# Start background listener
threading.Thread(target=revoker.subscribe_and_blacklist, daemon=True).start()

# Check tokens before accepting
if revoker.is_revoked(compute_hash(access_token)):
    return "Token revoked", 401