Revoke refresh token for a user

[medhost-sagar]

Hello everyone,
Is there a way to revoke a refresh token(s) for a user issued to any apps/clients without having the client secret for any of the apps (maybe via admin endpoint).
We still want to retain the consent but just invalidate refresh tokens that may have been issued to any app(s) on behalf of the user.

Appreciate your thoughts and suggestions.

[vinckr]

Yes, there are ways to revoke refresh tokens for a user in Ory.

• Revoke user consent on a per-application basis: You can use the Ory SDK to revoke user consent for a specific OAuth2 client. This will automatically revoke all related access and refresh tokens. There is a code snippet in the Ory documentation on how to do this.
• Revoke user consent for all applications: You can also use the Ory SDK to revoke user consent for all OAuth2 clients. This will also automatically revoke all related access and refresh tokens. There is a code snippet in the Ory documentation on how to do this.

Please note that these methods should not be used to invalidate user sessions.

[medhost-sagar]

Thank you @vinckr for your response on this. Both the approaches you suggested works well but it removes the consent given by the user as well.
Is there a way to just revoke refresh token without removing the consent. As I mentioned earlier, we still want to retain the consent given by the user. Revoking refresh token is only to enforce the user to login again with credentials on the app.

[vinckr]

I don't think there is a way to do that.
Can you elaborate a bit on the use case for revoke refresh token without removing the consent ?

[medhost-sagar]

Sure, Here the use case is more on security standpoint.
Say for example, if the user's password was changed or if the user's account was inactivated temporarily, in such cases we want to deactivate/disable the use of refresh token issued on that user's behalf to the app/client. And user will need to login again to the app by entering credentials and authenticating.
Also, if user has multiple devices with the app and if he loses one of the device. For security he/she may decide to change the password, and that should result in revoking refresh token for all the devices so that without entering new credentials app cannot access data/API.
I am curious to know how would this be handled today.