Currently it is Impossible to get Refresh Token to revoke it

[mikhail-slauth]

Currently it is Impossible to get current Refresh Token to revoke it

I need to revoke Refresh Token on log out (see https://auth0.com/docs/secure/tokens/refresh-tokens/revoke-refresh-tokens), but this is not possible, because I can't get it anyhow via current api. For some reasons refresh_token is omitted from getAccessTokenSilently method (see https://github.com/auth0/auth0-spa-js/blob/master/src/global.ts#L641).

Possible solutions

Implement dedicated method revokeRefreshToken which will revoke current refresh token according to doc in https://auth0.com/docs/secure/tokens/refresh-tokens/revoke-refresh-tokens

[frederikprijck]

Thank you for reaching out!

This is a fair request, as we do not offer a way for you to revoke refresh tokens. This is something we would want to look into and see if and how we can improve to acomodate for this.

I will raise this within our team to have a conversation about this, and if/how we could best offer a solution for this.

[ormagomy]

I would like to add my support for this request. I recently reached out to Auth0 support requesting this same functionality, but just now saw this issue/feature request. We are currently working around this with a manual, hacky solution. I would much prefer to have a built-in, supported way to either get the refresh token, revoke the refresh token, or both.

[ewanharris]

Hey @mikhail-slauth, thanks again for opening this issue.

We’ve investigated the feasibility of supporting refresh token revocation directly in this SDK and have decided that, for now, we won’t implement an API for it given that there is a solution for this already (outlined below), and this SDKs support for multiple audiences and scopes there could be some confusion around the API.

For now, our recommendation would be that if a refresh token revocation is required to call getTokenSilently({ ignoreCache: true }). Combined with the use of rotating refresh tokens, this will invalidate the previous refresh token ensuring it cannot be used again.

We will definitely continue to consider this request in future however.