Gitter OAuth session persistence after upstream credential revocation

Gitter OAuth session persistence after upstream credential revocation

This concerns the Gitter web application using OAuth 2.0 with GitHub or GitLab as the identity provider. A user revokes Gitter's OAuth authorization in the provider settings, expecting the linked Gitter session to end immediately. Gitter delegates credential expiration to the third-party provider and issues its own session token after the OAuth handshake. It is unclear whether revoking the upstream grant invalidates the existing Gitter session or whether the session remains active until the Gitter-issued token expires.

The least-privilege boundary is also fixed by the scopes accepted during the original authorization, with no documented mechanism to reduce scopes without re-authenticating.

Does revoking GitHub or GitLab access terminate an active Gitter session immediately? Can a user shorten the Gitter session lifetime independently of the identity provider? Are scoped permissions revisable without a full OAuth re-authorization?