[13.x] Support Token Revocation RFC7009 and Token Introspection RFC7662

[hafezdivandari]

• Support token revocation and introspection thephpleague/oauth2-server#1473

Token Revocation

Token Revocation RFC7009

First, enable the token revocation by calling the Passport::enableTokenRevocation method in the boot method of your application's App\Providers\AppServiceProvider class:

Passport::enableTokenRevocation();

Then, the consuming application should make a POST request to your application's /oauth/revoke route:

Http::asForm()->post('https://laravel.test/oauth/revoke', [
    'client_id' => 'your-client-id',
    'client_secret' => 'your-client-secret', // Required for confidential clients only...
    'token' => 'your-token-here',            // Either an access token or a refresh token to revoke...
    'token_type_hint' => 'access_token',     // Optional, to help the server optimize the token lookup. 'access_token' or 'refresh_token'...
]);

This will return an empty 200 response.

Token Introspection

Token Introspection RFC7662

First, enable the token introspection by calling the Passport::enableTokenIntrospection method in the boot method of your application's App\Providers\AppServiceProvider class:

Passport::enableTokenIntrospection();

Then, the consuming application should make a POST request to your application's /oauth/introspect route:

Http::asForm()->post('https://laravel.test/oauth/introspect', [
    'client_id' => 'your-client-id',
    'client_secret' => 'your-client-secret', // Required for confidential clients only...
    'token' => 'your-token-here',            // Either an access token or a refresh token to introspect...
    'token_type_hint' => 'access_token',     // Optional, to help the server optimize the token lookup. 'access_token' or 'refresh_token'...
]);

This will return a JSON response containing active attribute that indicates whether or not the presented token is currently active.

[github-actions]

Thanks for submitting a PR!

Note that draft PR's are not reviewed. If you would like a review, please mark your pull request as ready for review in the GitHub user interface.

Pull requests that are abandoned in draft may be closed due to inactivity.