From 770360c2cf67c98467f7920edaa30f4a991afae4 Mon Sep 17 00:00:00 2001 From: Oskar Eichler <62393985+OskarEichler@users.noreply.github.com> Date: Fri, 28 Aug 2026 04:18:12 +0300 Subject: [PATCH 1/2] fix: encode revocation requests and preserve discovery failures --- .changeset/appauth-revocation-encoding.md | 5 +++++ docs/docs/usage/revoke.md | 16 +++++++++++++++- packages/react-native-app-auth/index.js | 22 ++++++++++++++++++---- 3 files changed, 38 insertions(+), 5 deletions(-) create mode 100644 .changeset/appauth-revocation-encoding.md diff --git a/.changeset/appauth-revocation-encoding.md b/.changeset/appauth-revocation-encoding.md new file mode 100644 index 000000000..2f6ccd461 --- /dev/null +++ b/.changeset/appauth-revocation-encoding.md @@ -0,0 +1,5 @@ +--- +"react-native-app-auth": patch +--- + +Form-encode raw token/client values and OAuth Basic credential components, preserving reserved characters and Unicode. Treat an omitted Basic secret as empty, normalize one trailing issuer slash, reject failed discovery HTTP responses, and retain the original revocation network error as cause. diff --git a/docs/docs/usage/revoke.md b/docs/docs/usage/revoke.md index 6a4bba7db..a624c6dd5 100644 --- a/docs/docs/usage/revoke.md +++ b/docs/docs/usage/revoke.md @@ -12,13 +12,27 @@ import { revoke } from 'react-native-app-auth'; const config = { issuer: '', clientId: '', + // Only if your provider requires Basic client authentication: + // clientSecret: '', redirectUrl: '', scopes: [''], }; const result = await revoke(config, { tokenToRevoke: ``, - includeBasicAuth: true, + includeBasicAuth: false, sendClientId: true, }); ``` + +Set `includeBasicAuth` only when required by your provider; it uses `clientId` and `clientSecret` +(an omitted secret is empty). Embedded client secrets cannot be kept confidential in a native app; +see [Client Secrets](/docs/client-secrets). + +Pass raw token and credential values, not pre-encoded strings. The library applies form encoding to +the request body and Basic authentication components, including reserved characters and Unicode. +An issuer's trailing slash is handled when requesting discovery. Failed discovery HTTP responses reject +before revocation is attempted, and revocation network failures retain the original error as `cause`. + +The runtime result is the fetch response. Inspect its `ok` or `status` to confirm revocation succeeded; +a resolved HTTP error response does not mean the provider revoked the token. diff --git a/packages/react-native-app-auth/index.js b/packages/react-native-app-auth/index.js index a49c3c58c..c97e9969f 100644 --- a/packages/react-native-app-auth/index.js +++ b/packages/react-native-app-auth/index.js @@ -329,6 +329,11 @@ export const refresh = ( return wrapNativeAuthPromise(RNAppAuth.refresh(...nativeMethodArguments)); }; +const encodeFormComponent = value => + encodeURIComponent(value) + .replace(/[!'()~]/g, character => `%${character.charCodeAt(0).toString(16).toUpperCase()}`) + .replace(/%20/g, '+'); + export const revoke = async ( { clientId, issuer, serviceConfiguration, clientSecret }, { tokenToRevoke, sendClientId = false, includeBasicAuth = false } @@ -341,7 +346,10 @@ export const revoke = async ( if (serviceConfiguration && serviceConfiguration.revocationEndpoint) { revocationEndpoint = serviceConfiguration.revocationEndpoint; } else { - const response = await fetch(`${issuer}/.well-known/openid-configuration`); + const response = await fetch(`${issuer.replace(/\/$/, '')}/.well-known/openid-configuration`); + if (response.ok === false) { + throw new Error(`Failed to fetch the openid config: HTTP ${response.status}`); + } const openidConfig = await response.json(); invariant( @@ -356,7 +364,9 @@ export const revoke = async ( 'Content-Type': 'application/x-www-form-urlencoded', }; if (includeBasicAuth) { - headers.Authorization = `Basic ${base64.encode(`${clientId}:${clientSecret}`)}`; + headers.Authorization = `Basic ${base64.encode( + `${encodeFormComponent(clientId)}:${encodeFormComponent(clientSecret ?? '')}` + )}`; } /** Identity Server insists on client_id being passed in the body, @@ -367,9 +377,13 @@ export const revoke = async ( return await fetch(revocationEndpoint, { method: 'POST', headers, - body: `token=${tokenToRevoke}${sendClientId ? `&client_id=${clientId}` : ''}`, + body: `token=${encodeFormComponent(tokenToRevoke)}${ + sendClientId ? `&client_id=${encodeFormComponent(clientId)}` : '' + }`, }).catch(error => { - throw new Error('Failed to revoke token', error); + const revocationError = new Error('Failed to revoke token'); + revocationError.cause = error; + throw revocationError; }); }; From 54b6c83525d9bf63ef5fb11424e4c8868ce3142c Mon Sep 17 00:00:00 2001 From: Oskar Eichler <62393985+OskarEichler@users.noreply.github.com> Date: Fri, 28 Aug 2026 04:22:40 +0300 Subject: [PATCH 2/2] Keep empty revocation credentials compatible with the supported parser --- packages/react-native-app-auth/index.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/packages/react-native-app-auth/index.js b/packages/react-native-app-auth/index.js index c97e9969f..dda6d45a1 100644 --- a/packages/react-native-app-auth/index.js +++ b/packages/react-native-app-auth/index.js @@ -365,7 +365,7 @@ export const revoke = async ( }; if (includeBasicAuth) { headers.Authorization = `Basic ${base64.encode( - `${encodeFormComponent(clientId)}:${encodeFormComponent(clientSecret ?? '')}` + `${encodeFormComponent(clientId)}:${encodeFormComponent(clientSecret == null ? '' : clientSecret)}` )}`; } /**