Hydra OAuth2 server ↔ client application: automatic refresh‑token revocation on logout

Goal

Determine whether Ory Hydra should automatically revoke all refresh tokens when a user logs out, so that downstream client applications receive a consistent token state without extra revocation calls.

Constraints and uncertainty

• Hydra’s current implementation requires an explicit call to /oauth2/revoke for each refresh token; no built‑in flag enforces automatic revocation on logout.
• Community discussions have proposed a configuration option (e.g., auto_revoke_refresh_tokens), but it is not documented as stable.
• Enabling automatic revocation forces re‑authentication for users, potentially degrading experience for long‑lived sessions.
• Token introspection results must remain accurate regardless of the revocation policy.

Open questions

1. What are the security and usability trade‑offs of enabling automatic refresh‑token revocation on logout?
2. Does Hydra expose a stable configuration flag to control this behavior, and if so, which versions support it?
3. How does the chosen policy affect the /oauth2/introspect response for previously issued refresh tokens?