Feature: Remove refresh token from Active devices on logout Description: When a user logs out of a SPA, calling the logout endpoint does not revoke the refresh token. This leaves it available for use if it is compromised on the client-side or in transit. The revoke refresh token endpoint can be cal…

Revoke Refresh Token on Logout

kuba.prokopiuk November 24, 2023, 11:32am 9

+1 from me as well, facing a similar issue to the one @asatretdinov described.

November 2023 Community News

Topic		Replies	Views
Refresh token revocation on logout (SPA - Pentest Finding) Get Help configuration , application	2	12	February 18, 2026
Unable to revoke refresh tokens Get Help auth0 , refresh-tokens	2	2239	December 21, 2022
Failure to revoke refresh token Get Help refresh-tokens	4	2978	December 22, 2022
SPA With Auth0 Automatically Logs Out on Page Refresh Issue Get Help logout , sessions	0	977	July 31, 2023
Unable to fully logout when using refresh tokens Get Help	2	3485	August 5, 2022