Revoke Refresh token not working

Question

So I have a refresh token and it is showing under the user in the oAuth Connected Apps related list.

I am sending this code to revoke but the oAuth Connected Apps still shows it in the list (yes I refreshed the page).

I am missing something simple here!

    HttpRequest req = new HttpRequest();
    Http http = new Http();

    req.setMethod('POST');
    req.setEndpoint('https://login.salesforce.com/services/oauth2/revoke');
    req.setHeader('Content-Type','application/x-www-form-urlencoded');
    req.setBody('token=' + rt.refresh_Token__c);

    HTTPResponse resp = http.send(req);

I get this as the log:

31.0 APEX_CODE,DEBUG;APEX_PROFILING,INFO;CALLOUT,FINEST;DB,INFO;SYSTEM,ERROR;VALIDATION,ERROR;VISUALFORCE,ERROR;WORKFLOW,ERROR
15:58:32.081 (81310553)|EXECUTION_STARTED
15:58:32.081 (81348406)|CODE_UNIT_STARTED|[EXTERNAL]|066i0000004BkFG|VF: /apex/oAuth_Page
15:58:32.086 (86530359)|CODE_UNIT_STARTED|[EXTERNAL]|01pi0000006JK84|oAuth_Controller invoke(revoke_it)
15:58:32.086 (86742924)|METHOD_ENTRY|[1]|01pi0000006JK84|oAuth_Controller.oAuth_Controller()
15:58:32.086 (86807966)|METHOD_EXIT|[1]|oAuth_Controller
15:58:32.087 (87104009)|ENTERING_MANAGED_PKG|
15:58:32.108 (108347266)|ENTERING_MANAGED_PKG|
15:58:32.108 (108390664)|USER_DEBUG|[80]|ERROR|System.HttpRequest[Endpoint=https://login.salesforce.com/services/oauth2/revoke, Method=POST]
15:58:32.108 (108481672)|ENTERING_MANAGED_PKG|
15:58:32.108 (108493347)|USER_DEBUG|[81]|ERROR|token=adkjadkjksdjksjd
15:58:32.108 (108585693)|CALLOUT_REQUEST|[83]|System.HttpRequest[Endpoint=https://login.salesforce.com/services/oauth2/revoke, Method=POST]
15:58:32.415 (415289685)|CALLOUT_RESPONSE|[83]|System.HttpResponse[Status=Found, StatusCode=302]
15:58:32.415 (415461161)|ENTERING_MANAGED_PKG|
15:58:32.415 (415476689)|USER_DEBUG|[84]|ERROR|
15:58:32.415 (415509059)|ENTERING_MANAGED_PKG|
15:58:32.415 (415663332)|ENTERING_MANAGED_PKG|
15:58:32.419 (419519959)|CODE_UNIT_FINISHED|oAuth_Controller invoke(revoke_it)
15:58:32.420 (420111562)|VF_APEX_CALL|j_id4|{!revoke_it}|PageReference: none
15:58:32.944 (424486063)|CUMULATIVE_LIMIT_USAGE

But the app still show in the oAuth connected apps and the use of the refresh token continues to work.

Now if I put

https://login.salesforce.com/services/oauth2/revoke?token=xxxxxxx

directly in the browser it successfully revokes it.

Yet this does not

    HttpRequest req = new HttpRequest();
    Http http = new Http();

    req.setMethod('GET');
    req.setEndpoint('https://login.salesforce.com/services/oauth2/revoke?token=' + encodingUtil.urlencode(rt.Batch_Refresh_Token__c,'UTF-8'));
    HTTPResponse resp = http.send(req);
    system.debug(logginglevel.error,resp.getBody());

Answer 1

Isn't a 302 a redirect? Something isn't right.

Update from comments:

The redirect location was to the specific Pod. E.g. na15.salesforce.com/services/oauth2/revoke?token=xxxxxx

Sending the POST request there worked.

---

From Revoking OAuth Tokens

The authorization server indicates successful processing of the request by returning an HTTP status code 200. For all error conditions, a status code 400 is used along with one of the following error responses.

• unsupported_token_type—token type not supported
• invalid_token—the token was invalid

For a sandbox, use test.salesforce.com instead of login.salesforce.com.

Also, do you need to URL encode the token when sending it in the POST body? I suspect you don't.

It would make sense to URL encode it using the GET alternative.

https://login.salesforce.com/services/oauth2/revoke?token=currenttokenID

If it works in the browser then it will be one of two things:

1. There is a cookie that the browser is submitting with the GET request that is required (unlikely)
2. The browser is formatting the query string parameter in the expected format. Try checking the result of your URL encoding.