Revoke? about passport-github HOT 6 CLOSED

same question.

from passport-github.

Is 's seem passport projet is not maintened

from passport-github.

Passport provides authentication only, in the case of GitHub it does this by obtaining an access token and the user's profile information. Any token revocation is out-of-scope, and needs to be handled by the application, by calling the relevant GitHub API

from passport-github.

Is https://oauth.net/2/token-revocation/ not an option?

from passport-github.

If GitHub supports that API, then it would be, but I don't think they do. Either way, any token revocation would need to happen after authentication, and is not a feature of Passport.

from passport-github.

@jaredhanson, yes this is what I did. But i was wondering if there is a possibility just to logout or to delete the cookie "user_session" that is generate with github instead.
I make a test with passport-facebook, I observe the same behaviour. When I login, after logout, the session with my client and the express server is closed. But If i click again on the login Facebook, it's reconnect without prompting for password. I think this is a security problem.

Passport provides authentication only, in the case of GitHub it does this by obtaining an access token and the user's profile information. Any token revocation is out-of-scope, and needs to be handled by the application, by calling the relevant GitHub API

from passport-github.