OAuth 2.0 Token Revocation Response Limits for Invalid Tokens

RFC 7009 Compliance and Token Enumeration

The OAuth 2.0 Token Revocation specification (RFC 7009) defines a standardized mechanism for clients to invalidate access and refresh tokens. A critical security requirement of this specification is the prevention of token enumeration, which ensures that an attacker cannot determine if a specific token is valid by observing the server's response.

In a distributed environment, the behavior of the revocation endpoint must remain consistent regardless of whether the token is currently active, has already expired, or was never issued. This creates a specific constraint on the HTTP response codes returned to the client during the revocation request.

Implementation Uncertainty

There is a design tension between providing detailed debugging information to legitimate clients and maintaining the security symmetry required to prevent enumeration. Specifically, the handling of 'phantom' tokens—those that are syntactically correct but non-existent in the data store—must be carefully managed.

• What is the required HTTP response code when a client attempts to revoke a token that is already invalid or does not exist?
• Does the specification allow for different response codes based on the token type (access vs. refresh) if the token is invalid?