Feature: Remove refresh token from Active devices on logout Description: When a user logs out of a SPA, calling the logout endpoint does not revoke the refresh token. This leaves it available for use if it is compromised on the client-side or in transit. The revoke refresh token endpoint can be cal…

Hey there! Thank you for creating this feedback card. Let’s see who else from community will be interested in such improvement!

finally :slight_smile: , i have found one paragraph about that behavior in official documentation, maybe someone will be interested in Token Best Practices could pls someone explain this behavior? because I fully agree with the author about the token leakage

Hi all! +1 for this feature. We are currently exploring the implementation of a centralized logout feature that spans across multiple applications deployed on distinct domains, specifically domain1 and domain2. Our objective is to enhance the user experience by ensuring that when a user initiates …

+1 here, this is an absolute need because of: [image] chris.witheridge: This leaves it available for use if it is compromised on the client-side or in transit. No support in the SDK means many security issues for sure for many users of Auth0.

+1 Here. It would be really nice have this.

+1 for me as well. It would make managing user’s sessions as an admin easier.

Yes, when a user logs out, the refresh token should be invalidated automatically. Auth0 should call the /revoke API itself.

+1, this is crucial for security, just in case any refresh_token is leaked, logging out is the quickest way to invalidate it/them!

+1 we really need this feature please!!! @konrad.sopala

Revoke Refresh Token on Logout

Product Feedback

kuba.prokopiuk November 24, 2023, 11:32am 9

+1 from me as well, facing a similar issue to the one @asatretdinov described.

November 2023 Community News

Topic		Replies	Views
Refresh token revocation on logout (SPA - Pentest Finding) Get Help configuration , application	2	109	February 18, 2026
Unable to revoke refresh tokens Get Help auth0 , refresh-tokens	1	2280	September 6, 2022
Failure to revoke refresh token Get Help refresh-tokens	3	3032	October 3, 2022
SPA With Auth0 Automatically Logs Out on Page Refresh Issue Get Help logout , sessions	0	988	July 31, 2023
Unable to fully logout when using refresh tokens Get Help	1	3538	July 21, 2022

Revoke Refresh Token on Logout

Related topics