OAuth createAccessToken /api/token revoking?

[erikwilson (Erik)]

Hello,

I am trying to use the super secret API methods of calling createAccessToken/revokeAccessToken in combination with /api/token endpoints as used in the Quirky App, however I am having some issues attempting to revoke the created token afterwards.

I am attempting to use the /api/token endpoint in an OAuth callback to avoid having the user log into both an external service and the SmartThings service which they are already authenticated to. This works (is there documentation for /api/token anywhere?), however as the token has been transmitted through the clear in the url I need to revoke it to ensure the security of the SmartThings account. There is a method called revokeAccessToken() however this does not seem to actually revoke the token created with createAccessToken().

Does anybody have a solution for revoking tokens?

Thanks!
-Erik

Here are some other possibly related threads in which I could not find an answer:

OAuth access token expiry and refresh token API

On going through the OAuth based SmartApp development process, I noticed that the access token generated has a very long expiry. The ‘expires_in’ field is set to ‘1576799999’ which translates to approximately 50 years if the property is implemented as seconds (Please correct me if i’m wrong). Will this access token expiry time reduced in future for better security? Also i couldn’t find any API for refreshing the access token. Is this implemented somewhere?

Updated Developer Docs!

I couldn’t agree more. A little more info - if this were as easy as it sounds, we would have doc’d this already. We are in conversations with engineering to get to this list identified and published, so it’s not being ignored. I can’t give an ETA with any confidence, but my gut tells me it may be difficult to get this out prior to v2 launch.

[justinlhudson]

The only way I know of to revoke the token is to uninstall the app and install again. Not the best solution, but does the trick.

[625alex (Alex, ActionTiles Control Panel)]

If anyone ever finds out, please let me know.

[RBoy (www.rboyapps.com - Making SmartThings Easy!)]

Here’s an idea I’m using, if you want to revoke the token, just create a new token and don’t publish it to the user. If they try to use the old token it won’t work anymore.

[625alex (Alex, ActionTiles Control Panel)]

But the old token still works!

[RBoy (www.rboyapps.com - Making SmartThings Easy!)]

Hmm not with me, once I create a new code the old one doesn’t work anymore. I just call:

createAccessToken()

and the old one no longer works.

[625alex (Alex, ActionTiles Control Panel)]

How long ago did you try this?

Prior to about October of last year, calling createAccessToken() would invalidate the previous one. Then something happened at the back end and it became impossible to invalidate old tokens. ST developers were not aware of any such changes. I know, because I tried several ridiculous workarounds to remedy this change in behavior.

There was this recent conversation on the topic:

OAuth Token Revocation

Continuing the discussion from Changes for OAuth Access Token Requests: What’s the story with OAuth token revocation? I cannot find any documented way to revoke previously issued OAuth tokens. It’s a serious security issue if tokens cannot be revoked. It pretty much defeats the purpose of using OAuth. Also, RFC 6749 recommends that tokens be revoked if authorization code is used more than once. Please correct me if I’m wrong, but I don’t think SmartThings follows this recommendation. 4.1.2. Authorization Response … If an authorization code is used more than once, the authorization server MUST deny the request and SHOULD revoke (when possible) all tokens previously issued based on that authorization code. 10.5. Authorization Codes … If the authorization server observes multiple…

I’m going to try this again. If it works the same way as it did last year, that will be pleasant surprise.

@Jim, if you could chime on this, that would be great.

[RBoy (www.rboyapps.com - Making SmartThings Easy!)]

I checked it about 2 weeks ago