{"action":"created","issue":{"url":"https://api.github.com/repos/simplabs/ember-simple-auth/issues/960","repository_url":"https://api.github.com/repos/simplabs/ember-simple-auth","labels_url":"https://api.github.com/repos/simplabs/ember-simple-auth/issues/960/labels{/name}","comments_url":"https://api.github.com/repos/simplabs/ember-simple-auth/issues/960/comments","events_url":"https://api.github.com/repos/simplabs/ember-simple-auth/issues/960/events","html_url":"https://github.com/simplabs/ember-simple-auth/issues/960","id":148389217,"number":960,"title":"OAuth2 revoke token request is not fired with correct authentication header","user":{"login":"pijey","id":1667958,"avatar_url":"https://avatars.githubusercontent.com/u/1667958?v=3","gravatar_id":"","url":"https://api.github.com/users/pijey","html_url":"https://github.com/pijey","followers_url":"https://api.github.com/users/pijey/followers","following_url":"https://api.github.com/users/pijey/following{/other_user}","gists_url":"https://api.github.com/users/pijey/gists{/gist_id}","starred_url":"https://api.github.com/users/pijey/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pijey/subscriptions","organizations_url":"https://api.github.com/users/pijey/orgs","repos_url":"https://api.github.com/users/pijey/repos","events_url":"https://api.github.com/users/pijey/events{/privacy}","received_events_url":"https://api.github.com/users/pijey/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/simplabs/ember-simple-auth/labels/wontfix","name":"wontfix","color":"ffffff"}],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":4,"created_at":"2016-04-14T14:58:57Z","updated_at":"2016-04-19T08:38:21Z","closed_at":"2016-04-14T15:14:01Z","body":"I'm using OAuth2 to secure my REST API (with Spring Security OAuth2) and ember-simple-auth with an OAuth2 authenticator for my ember app. Login works fine and API calls contain the *Authorization* header with the token.\r\n\r\nHowever on logout, when trying to revoke a token (by setting *serverTokenRevocationEndpoint* in the oauth authenticator), a POST request is sent with an *Authorization* header that contains the clientId, not the token.\r\n\r\nIMO, the token revocation endpoint shoud only be accessible by authenticated users (and an authenticated user should only be able to revoke its own tokens, but that's a server matter :) ) so in my case, I'm getting a 401.\r\n\r\nI overrode the makeRequest method with the following (ugly) hack to make it work :\r\n\r\n```javascript\r\nmakeRequest(url, data) {\r\n\tconst options = {\r\n\t  url,\r\n\t  data,\r\n\t  type:        'POST',\r\n\t  dataType:    'json',\r\n\t  contentType: 'application/x-www-form-urlencoded'\r\n\t};\r\n\r\n\tconst clientIdHeader = this.get('_clientIdHeader');\r\n\tif (!isEmpty(clientIdHeader)) {\r\n\t  \toptions.headers = clientIdHeader;\r\n\t}\r\n\tconst token = data.token;\r\n\tif(!isEmpty(data.token_type_hint)){\r\n\t\toptions.headers = {Authorization: `Bearer ${token}`};\r\n\t}\r\n\r\n\treturn Ember.$.ajax(options);\r\n\t},\r\n```\r\nBy default, should'nt the revoke request header contain the token *Authorization* header ?\r\n\r\nThanks!"},"comment":{"url":"https://api.github.com/repos/simplabs/ember-simple-auth/issues/comments/211798499","html_url":"https://github.com/simplabs/ember-simple-auth/issues/960#issuecomment-211798499","issue_url":"https://api.github.com/repos/simplabs/ember-simple-auth/issues/960","id":211798499,"user":{"login":"pijey","id":1667958,"avatar_url":"https://avatars.githubusercontent.com/u/1667958?v=3","gravatar_id":"","url":"https://api.github.com/users/pijey","html_url":"https://github.com/pijey","followers_url":"https://api.github.com/users/pijey/followers","following_url":"https://api.github.com/users/pijey/following{/other_user}","gists_url":"https://api.github.com/users/pijey/gists{/gist_id}","starred_url":"https://api.github.com/users/pijey/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pijey/subscriptions","organizations_url":"https://api.github.com/users/pijey/orgs","repos_url":"https://api.github.com/users/pijey/repos","events_url":"https://api.github.com/users/pijey/events{/privacy}","received_events_url":"https://api.github.com/users/pijey/received_events","type":"User","site_admin":false},"created_at":"2016-04-19T08:38:21Z","updated_at":"2016-04-19T08:38:21Z","body":"In fact, I'm using the *password* grant type and the *revoke* endpoint is not in the Oauth2 server but I put it in the resource server (since Spring Security does not provide this endpoint natively) so I think it's the origin of the problem. I guess it's one limitation of OAuth2 when used to **authenticate** whereas it was designed to **authorize**.\r\n\r\nThanks for your explanation and sorry for the time loss ! I'll look into the OAuth2 spec to see if this protocol is the best choice for this project."}}