Look into implementation/use of revocation-url

[ackerleytng]

louketo seems to be calling the end_session_endpoint on keycloak, which is not the revocation endpoint, I believe? Keycloak seems to have an undocumented revocation endpoint at /revoke, according to keycloak/keycloak#6704.

If this is more of a logout endpoint than revocation endpoint, we should rename the config variable and improve docs.

Token revocation is defined by https://tools.ietf.org/html/rfc7009

[p53]

when i check my keycloak and also on stackoverflow, keycloak endpoints were:

    "issuer": "http://localhost:8080/auth/realms/demo",
    "authorization_endpoint": "http://localhost:8080/auth/realms/demo/protocol/openid-connect/auth",
    "token_endpoint": "http://localhost:8080/auth/realms/demo/protocol/openid-connect/token",
    "userinfo_endpoint": "http://localhost:8080/auth/realms/demo/protocol/openid-connect/userinfo",
    "end_session_endpoint": "http://localhost:8080/auth/realms/demo/protocol/openid-connect/logout",
    "jwks_uri": "http://localhost:8080/auth/realms/demo/protocol/openid-connect/certs",

so there wasn't any explicit revocation endpoint
also according this issue louketo#662, keycloak 10.0.0 introduces new revocation endpoint, however you can set any revocation endpoint through option, we can set new keycloak revocation endpoint as default

[p53]

as per keycloak implementation keycloak/keycloak#6704, they support in token parameter only refresh tokens, as found loginHandler doesn't provide refresh token in cookies so if logging in via loginHandler we are unable to logout because we don't have refresh token (unless enabled store, didn't check if that's not buggy...)