This proposal is about the OAuth2 module of SteemConnect. To be more precise - about the https://steemconnect.com/api/oauth2/token/revoke endpoint.
At the moment, there is no way to revoke refresh token via the https://steemconnect.com/api/oauth2/token/revoke endpoint.
Currently, this endpoint revokes the access token provided in the Authorization header. I believe it would be really useful for developers to be able to also revoke the refresh token.
My proposal is to change the current behavior of the https://steemconnect.com/api/oauth2/token/revoke endpoint. Here is how it IMO could work:
The core concept is that not the access_token provided in the Authorization header is being revoked, but token provided in the request's body.
It would enable a developer to implement revoking both refresh token and access token using the same endpoint.
As you can see, the headers section would include:
and body:
In my opinion, if token_type_hint was refresh_token, SteemConnect should revoke both access token and refresh token.
If token_type_hint was access_token, SteemConnect should only revoke access token.
For more information check this paper:
With revocable refresh token via the /api/oauth2/token/revoke endpoint, a developer would be able to delete all tokens of the user if one didn't need them anymore. My proposal would enable to use offline scope more safety.
