3

So I have a refresh token and it is showing under the user in the oAuth Connected Apps related list.

I am sending this code to revoke but the oAuth Connected Apps still shows it in the list (yes I refreshed the page).

I am missing something simple here!

    HttpRequest req = new HttpRequest();
    Http http = new Http();

    req.setMethod('POST');
    req.setEndpoint('https://login.salesforce.com/services/oauth2/revoke');
    req.setHeader('Content-Type','application/x-www-form-urlencoded');
    req.setBody('token=' + rt.refresh_Token__c);

    HTTPResponse resp = http.send(req);

I get this as the log:

31.0 APEX_CODE,DEBUG;APEX_PROFILING,INFO;CALLOUT,FINEST;DB,INFO;SYSTEM,ERROR;VALIDATION,ERROR;VISUALFORCE,ERROR;WORKFLOW,ERROR
15:58:32.081 (81310553)|EXECUTION_STARTED
15:58:32.081 (81348406)|CODE_UNIT_STARTED|[EXTERNAL]|066i0000004BkFG|VF: /apex/oAuth_Page
15:58:32.086 (86530359)|CODE_UNIT_STARTED|[EXTERNAL]|01pi0000006JK84|oAuth_Controller invoke(revoke_it)
15:58:32.086 (86742924)|METHOD_ENTRY|[1]|01pi0000006JK84|oAuth_Controller.oAuth_Controller()
15:58:32.086 (86807966)|METHOD_EXIT|[1]|oAuth_Controller
15:58:32.087 (87104009)|ENTERING_MANAGED_PKG|
15:58:32.108 (108347266)|ENTERING_MANAGED_PKG|
15:58:32.108 (108390664)|USER_DEBUG|[80]|ERROR|System.HttpRequest[Endpoint=https://login.salesforce.com/services/oauth2/revoke, Method=POST]
15:58:32.108 (108481672)|ENTERING_MANAGED_PKG|
15:58:32.108 (108493347)|USER_DEBUG|[81]|ERROR|token=adkjadkjksdjksjd
15:58:32.108 (108585693)|CALLOUT_REQUEST|[83]|System.HttpRequest[Endpoint=https://login.salesforce.com/services/oauth2/revoke, Method=POST]
15:58:32.415 (415289685)|CALLOUT_RESPONSE|[83]|System.HttpResponse[Status=Found, StatusCode=302]
15:58:32.415 (415461161)|ENTERING_MANAGED_PKG|
15:58:32.415 (415476689)|USER_DEBUG|[84]|ERROR|
15:58:32.415 (415509059)|ENTERING_MANAGED_PKG|
15:58:32.415 (415663332)|ENTERING_MANAGED_PKG|
15:58:32.419 (419519959)|CODE_UNIT_FINISHED|oAuth_Controller invoke(revoke_it)
15:58:32.420 (420111562)|VF_APEX_CALL|j_id4|{!revoke_it}|PageReference: none
15:58:32.944 (424486063)|CUMULATIVE_LIMIT_USAGE

But the app still show in the oAuth connected apps and the use of the refresh token continues to work.

Now if I put 

https://login.salesforce.com/services/oauth2/revoke?token=xxxxxxx

directly in the browser it successfully revokes it.

Yet this does not

    HttpRequest req = new HttpRequest();
    Http http = new Http();

    req.setMethod('GET');
    req.setEndpoint('https://login.salesforce.com/services/oauth2/revoke?token=' + encodingUtil.urlencode(rt.Batch_Refresh_Token__c,'UTF-8'));
    HTTPResponse resp = http.send(req);
    system.debug(logginglevel.error,resp.getBody());
Improve this question
2

Isn't a 302 a redirect? Something isn't right.

Update from comments:

The redirect location was to the specific Pod. E.g. na15.salesforce.com/services/oauth2/revoke?token=xxxxxx

Sending the POST request there worked.

From Revoking OAuth Tokens

The authorization server indicates successful processing of the request by returning an HTTP status code 200. For all error conditions, a status code 400 is used along with one of the following error responses.

  • unsupported_token_type—token type not supported
  • invalid_token—the token was invalid

For a sandbox, use test.salesforce.com instead of login.salesforce.com.

Also, do you need to URL encode the token when sending it in the POST body? I suspect you don't.

It would make sense to URL encode it using the GET alternative.

https://login.salesforce.com/services/oauth2/revoke?token=currenttokenID

If it works in the browser then it will be one of two things:

  1. There is a cookie that the browser is submitting with the GET request that is required (unlikely)
  2. The browser is formatting the query string parameter in the expected format. Try checking the result of your URL encoding.
Improve this answer
6
  • I am calling from inside a Packaging org. You are correct you do not need to encode, left over from trying various ways. I have tried with and without encoding with same results. I have updated my question with the debug logs for the entire request... – Eric Sep 25 '14 at 20:01
  • I have checked the value of the token in the body of the request and it is exactly the same as what I am sending if directly typed in the url. I also tried on three different browsers – Eric Sep 25 '14 at 20:07
  • 1
    I think the most telling thing you could do at the moment is to check the Location that is associated with the 302. It might indicate what the issue is. Also, what was the response to the GET request? – Daniel Ballinger Sep 25 '14 at 22:02
  • THANK YOU - Checking location, it seems that the initial POST actuals returns the URL redirect to the POD I am on: na15.salesforce.com/services/oauth2/revoke?token=xxxxxx so it seems I will need to just use my podprotocolandhost utility to skip this step – Eric Sep 25 '14 at 22:27
  • 1
    Funny how this important part does not appear to be in the documentation. Oh and the response to the get request was the same – Eric Sep 25 '14 at 22:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.