Movatterモバイル変換


[0]ホーム

URL:


Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

Sign up
Appearance settings

feat: implement oauth2 RFC 7009 token revocation endpoint#20362

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to ourterms of service andprivacy statement. We’ll occasionally send you account related emails.

Already on GitHub?Sign in to your account

Merged
Emyrk merged 11 commits intomainfromstevenmasley/revoke_oauth
Oct 22, 2025

Conversation

@Emyrk
Copy link
Member

@EmyrkEmyrk commentedOct 17, 2025
edited
Loading

Taken from#18809

The linked PR is too big, refactored some functions and fixed the test.

What this does

Adds RFC 7009 token revocation endpoint

@EmyrkEmyrk changed the titlefeat: oauth2 RFC 7009 token revocation endpointfeat: implement oauth2 RFC 7009 token revocation endpointOct 17, 2025
@EmyrkEmyrk marked this pull request as ready for reviewOctober 17, 2025 15:00
Comment on lines +35 to +36
// Secret is the raw secret value. This value should only be known to the client.
Secretstring
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

Why are we storing the secret?

Copy link
MemberAuthor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

TheFormatted stores the secret, so we were already storing the secret in this struct.

I added this field because the previous PR had 2 structs.

typeparsedSecretstruct {prefixstringsecretstring}typeAppSecretstruct {// Formatted contains the secret. This value is owned by the client, not the// server.  It is formatted to include the prefix.Formattedstring// Prefix is the ID of this secret owned by the server. When a client uses a// secret, this is the matching string to do a lookup on the hashed value.  We// cannot use the hashed value directly because the server does not store the// salt.Prefixstring// Hashed is the server stored hash(secret,salt,...). Used for verifying a// secret.Hashedstring}

TheparseFormattedSecret was inregistration.go. My refactor was to make 1 struct for theAppSecret and another forHashedAppSecret. I movedParseFormattedSecret next toGenerateSecret. I think we still need to workshop some better names to not conflate with other Secrets. Since it is in theoauth2provider package, I think that helps disambiguate it from say an APIKey secret

There is no new data being stored somewhere it was not previously.

Copy link
Member

@code-ashercode-asher left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

No blocking comments from me!

@EmyrkEmyrkforce-pushed thestevenmasley/revoke_oauth branch from31a1f6f todaf8ce3CompareOctober 22, 2025 17:48
@EmyrkEmyrk merged commit4bd7c7b intomainOct 22, 2025
33 of 35 checks passed
@EmyrkEmyrk deleted the stevenmasley/revoke_oauth branchOctober 22, 2025 20:18
@github-actionsgithub-actionsbot locked and limited conversation to collaboratorsOct 22, 2025
Sign up for freeto subscribe to this conversation on GitHub. Already have an account?Sign in.

Reviewers

@ThomasK33ThomasK33ThomasK33 left review comments

@code-ashercode-ashercode-asher approved these changes

Assignees

@EmyrkEmyrk

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@Emyrk@ThomasK33@code-asher

[8]ページ先頭

©2009-2025 Movatter.jp