How to revoke token?

[42gb]

Hello,

I might just not have found it yet. But im looking at the provided oauth client in masto.js and cannot find a way to call /oauth/revoke (https://docs.joinmastodon.org/methods/oauth/#revoke). What do I miss? How to revoke a token with masto.js?

Thanks in advance.

[neet]

Hi @42gb, thank you for posting a question.

As you pointed out, we didn't supportPOST /oauth/revoke API becuase Masto.js has long been dedicated for the REST and WebSocket API and has just introduced OAuth API support as of v6.0.0.

I've just released v6.5.0 with token revocation support #1011, and you can use it as follows:

import { createOAuthClient } from "masto";

const oauth = createOAuthClient({ ... });

await oauth.revoke({
  clientId: "...",
  clientSecret: "...",
  token: "...",
})

[42gb]

Hi @neet,

Oh I was not aware that OAuthAPIClient was just added. Thanks for updating. Was not expecting that :)

I updated my project to masto.js 6.5. And tried it out immediately.

createOAuthClient is not available to me. I guess this is just a typo and should be createOAuthAPIClient(). revoke() is available there after update. So far so good.

So I use it like this to test it out:

        const mastoAuth = createOAuthAPIClient({
            url: 'https://' + instance.value
        })

        await mastoAuth.revoke({
            clientId: client_id.value,
            clientSecret: client_secret.value,
            token: access_token.value
        })

Im running into problems:

When revoke() is called, I get an error in console that says (I replaced the instance with a placeholder '[instance_name]'):

Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at https://[instance_name]/oauth/revoke. (Reason: CORS header ‘Access-Control-Allow-Origin’ missing). Status code: 302.

Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at https://[instance_name]/oauth/revoke. (Reason: CORS request did not succeed). Status code: (null).

Im using masto.js in a Vue.js frontend app. Running it on localhost. All other calls I use from OAuthAPIClient and RestAPIClient running smoothly so far. I tested it with 2 different instances.

Im quite new to JS. I hope Im not wasting your time and this is related to masto.js.

[neet]

Unfortunately, I don't think this is a problem arising from Masto.js. The CORS error you mentioned says that the Mastodon server is not permitting us to execute /revoke API from a different origin (pair of protocols like http: and domain example.com), which indirectly means it's not available for third-party web clients.

c.f. https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Origin

You can report an issue on mastodon/mastodon to suggest an improvement or cast a question about this, but as far as I know, this is because of the security policy to prevent CSRF. I suspect that /oauth APIs are not designed to be executed via browsers unlike the REST and other endpoints.

Another option is to make a proxy server. The root cause of this problem is that the Mastodon server is requesting your browser to block the request towards them, so you can simply avoid this by not using a web browser during the /oauth/revoke API call. With Vue.js, you can use Nuxt.js also for creating a server-side API: https://nuxt.com/docs/guide/directory-structure/server

I hope this helps.

[42gb]

Hi @neet,

I think I got confused because OAuthAPIClient.token() is working from browser without backend.

Thanks for the clarification! Much appreciated.