{"action":"created","issue":{"url":"https://api.github.com/repos/doorkeeper-gem/doorkeeper/issues/891","repository_url":"https://api.github.com/repos/doorkeeper-gem/doorkeeper","labels_url":"https://api.github.com/repos/doorkeeper-gem/doorkeeper/issues/891/labels{/name}","comments_url":"https://api.github.com/repos/doorkeeper-gem/doorkeeper/issues/891/comments","events_url":"https://api.github.com/repos/doorkeeper-gem/doorkeeper/issues/891/events","html_url":"https://github.com/doorkeeper-gem/doorkeeper/issues/891","id":181146063,"node_id":"MDU6SXNzdWUxODExNDYwNjM=","number":891,"title":"Revoking token does not work for public clients","user":{"login":"ostinelli","id":110142,"node_id":"MDQ6VXNlcjExMDE0Mg==","avatar_url":"https://avatars0.githubusercontent.com/u/110142?v=4","gravatar_id":"","url":"https://api.github.com/users/ostinelli","html_url":"https://github.com/ostinelli","followers_url":"https://api.github.com/users/ostinelli/followers","following_url":"https://api.github.com/users/ostinelli/following{/other_user}","gists_url":"https://api.github.com/users/ostinelli/gists{/gist_id}","starred_url":"https://api.github.com/users/ostinelli/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ostinelli/subscriptions","organizations_url":"https://api.github.com/users/ostinelli/orgs","repos_url":"https://api.github.com/users/ostinelli/repos","events_url":"https://api.github.com/users/ostinelli/events{/privacy}","received_events_url":"https://api.github.com/users/ostinelli/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":16,"created_at":"2016-10-05T13:00:29Z","updated_at":"2018-07-11T13:48:20Z","closed_at":"2018-07-10T21:16:12Z","author_association":"NONE","body":"Hello,\nI'm using grant `implicit` to allow authorizing an application from mobile applications, by initiating the flow as follows:\n\n`https://example.com/oauth2/authorize?response_type=token&client_id={CLIENT_ID}&redirect_uri={REDIRECT_URI}&scope={REQUESTED_SCOPES}&state={STATE}\n`\n\nAfter a successful oauth flow, the generated token is saved in the `oauth_access_tokens` table jointly with the application referenced by the original `client_id` value:\n\n`#<Doorkeeper::AccessToken id: 396, resource_owner_id: 2, application_id: 1, token: \"49d9a5c6232d6880e9b8df1c9369edf6bfc00aceedd5bb8164...\", refresh_token: nil, expires_in: 1209600, revoked_at: nil, created_at: \"2016-10-05 12:37:11\", scopes: \"profile\">\n`\n\nThe `oauth_access_grants` table is empty, as expected since using `implicit`.\n\nWhen I try to revoke this token using the [POST /oauth/revoke API endpoint](https://github.com/doorkeeper-gem/doorkeeper/wiki/API-endpoint-descriptions-and-examples#post-oauthrevoke) (the one at the bottom, which does not require `client_id` or `client_secret` to be passed), it does not get revoked.\n\nDiving into the source code, I see in the `tokens_controller.rb`:\n\n```\n# OAuth 2.0 Section 2.1 defines two client types, \"public\" & \"confidential\".\n# Public clients (as per RFC 7009) do not require authentication whereas\n# confidential clients must be authenticated for their token revocation.\n#\n# Once a confidential client is authenticated, it must be authorized to\n# revoke the provided access or refresh token. This ensures one client\n# cannot revoke another's tokens.\n#\n# Doorkeeper determines the client type implicitly via the presence of the\n# OAuth client associated with a given access or refresh token. Since public\n# clients authenticate the resource owner via \"password\" or \"implicit\" grant\n# types, they set the application_id as null (since the claim cannot be\n# verified).\n#\n# https://tools.ietf.org/html/rfc6749#section-2.1\n# https://tools.ietf.org/html/rfc7009\n```\n\nHowever, as per above the token _does_ specify the `application_id`, despite having used the `implicit` grant type.\n\nHence, when I try to revoke this token I land in the controller's [`authorized?` method](https://github.com/doorkeeper-gem/doorkeeper/blob/v4.2.0/app/controllers/doorkeeper/tokens_controller.rb#L52):\n\n``` ruby\ndef authorized?\n  if token.present?\n    # Client is confidential, therefore client authentication & authorization\n    # is required\n    if token.application_id?\n      # We authorize client by checking token's application\n      server.client && server.client.application == token.application\n    else\n      # Client is public, authentication unnecessary\n      true\n    end\n  end\nend\n```\n\nWhere `token` is present and specifies an `application_id`, however `server.client` is `nil` hence `authorized?` returns false and the token does not get revoked.\n\nI'm using doorkeeper `4.2.0`.\n\nIs this expected behavior or am I missing something?\n\nThank you.\n"},"comment":{"url":"https://api.github.com/repos/doorkeeper-gem/doorkeeper/issues/comments/404175928","html_url":"https://github.com/doorkeeper-gem/doorkeeper/issues/891#issuecomment-404175928","issue_url":"https://api.github.com/repos/doorkeeper-gem/doorkeeper/issues/891","id":404175928,"node_id":"MDEyOklzc3VlQ29tbWVudDQwNDE3NTkyOA==","user":{"login":"f3ndot","id":740289,"node_id":"MDQ6VXNlcjc0MDI4OQ==","avatar_url":"https://avatars3.githubusercontent.com/u/740289?v=4","gravatar_id":"","url":"https://api.github.com/users/f3ndot","html_url":"https://github.com/f3ndot","followers_url":"https://api.github.com/users/f3ndot/followers","following_url":"https://api.github.com/users/f3ndot/following{/other_user}","gists_url":"https://api.github.com/users/f3ndot/gists{/gist_id}","starred_url":"https://api.github.com/users/f3ndot/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/f3ndot/subscriptions","organizations_url":"https://api.github.com/users/f3ndot/orgs","repos_url":"https://api.github.com/users/f3ndot/repos","events_url":"https://api.github.com/users/f3ndot/events{/privacy}","received_events_url":"https://api.github.com/users/f3ndot/received_events","type":"User","site_admin":false},"created_at":"2018-07-11T13:48:20Z","updated_at":"2018-07-11T13:48:20Z","author_association":"CONTRIBUTOR","body":"CVE-2018-1000211 assigned."}}
{"actor":{"display_login":"f3ndot"}}