Impact of revoking an access token on the refresh token

[sagarshah1983]

Hello everyone,
I have a question related to oauth2/revoke endpoint - during revoke, does anyone know if it should revoke refresh token as well when revoking bearer access token. I could not find it clear from documentation, but that’s how it was functioning when I tried it.

Appreciate your views.

Regards,
Sagar

[Benehiko]

Hi @sagarshah1983

It seems to be the case. Please see the fosite RevokeToken function.

Also as the specs note

If the token passed to the request
is an access token, the server MAY revoke the respective refresh
token as well.

https://datatracker.ietf.org/doc/html/rfc7009#section-2.1

[sagarshah1983]

Thanks @Benehiko for clarifying and confirming!