Hydra OAuth2 server ↔ client application: automatic refresh‑token revocation on logout

Answer

Hydra does not automatically revoke refresh tokens on logout. The OAuth2 token lifecycle is intentionally decoupled from the identity provider session. When a user logs out, only the IdP session is destroyed; refresh tokens remain valid until explicitly revoked via /oauth2/revoke.

Confirmed Behavior

In stable Hydra releases (v1.10+), there is no configuration flag such as auto_revoke_refresh_tokens that enables automatic token revocation on logout. The /oauth2/introspect endpoint will continue to return active: true for refresh tokens issued before logout until a revocation call is made.

Implementation Path

To achieve automatic revocation, your client application must:

1. Intercept the logout event at your identity provider or application layer.
2. Retrieve the user's active refresh tokens (typically stored or cached during token issuance).
3. Issue a POST request to /oauth2/revoke for each refresh token.
4. Optionally, clear the local session state.

Trade-offs

Enabling automatic revocation provides stronger security by ensuring no downstream client retains access after logout. However, it forces immediate re-authentication for all clients, which may degrade usability for users with multi-device sessions.

Verification Steps

1. Use a refresh token to obtain a new access token.

2. Log out from the IdP.

3. Attempt to use the same refresh token at /oauth2/token — it will succeed, confirming tokens are not auto-revoked.

4. Call /oauth2/revoke with the refresh token.

5. Query /oauth2/introspect — active will return false.