Revoke id token Google oauth2 java

Question

I want to revoke the session of a user logged in to my app with google authentication.

I retrieved the informations for this user available on this image. Among them we find his token, useful for the revoke.

According to the documentation provided by Google there is a REST call to answer my problem. https://developers.google.com/identity/protocols/oauth2/web-server#tokenrevoke

However I get this error every time :

The requested URL /revoke?token=eyJhbGciOiJSUzI1NiIsImt.......... was not found on this server. That’s all we know.

Maybe the token which is not valid but I don't understand why in this case.

Answer 1

I think we need to start with being clear as to what it is you are trying to do.

If you are trying to log the user out of their google account the anwser is you cant. Google does not allow third party apps to log users out of their accoutns.

If you are trying to log the user just out of your app itself. Then assuming you have a web app just delete the session or the cookie depending upon how your system is running.

If it is an installed app again just delete the stored tokens which you either have stored in a var you are passing around or in your database.

If you want to completely have the users consent to your using their Google data removed then you would use the revoke command. Revoke world require that you send a valid access token. This will remove all consent that the user has granted your application to access their data. Revoke is not preformed on an Id token.

However by looking at your image I can see that you have an id token, which implies to me that you are using Google signin which is not Oauth2. Revoke is intended for use with Oauth2. Try sending the one that say authToken that might work. If not I think you should just remove the session cookies.

Answer 2

POST request works, GET request return the known error