Does the oauth2/logout user invalidate any refresh tokens issued to the user

Question

I am using the /oauth2/logout endpoint to log a user out of fusionauth as described here.

I know that the JWT will be valid till it expires and we can use webhooks to invalidate it if needed before expiry. But do we need to explicitly expire any refresh token issued to the user or does fusionauth automatically invalidates them?

Answer 1

The OAuth2 core specification doesn't include token revocation. But revoking tokens has been specified through an "extension" to the standard (see RFC7009).

The thing is, API providers generally don't include a URL in their API to handle token revocation. They mostly rely on access_token expiration.

With this said, as per FusionAuth only, I've found this issue that explain why it's not broadly supported.