Steps to replicate the issue:
- Create OAuth2 consumer (not owner-only) with some grants like edit.
- Authorize the consumer, store access and refresh token
- Revoke authorization of the consumer using Special:OAuthManageMyGrants
- Try to edit the wiki using the stored access token. It fails with below error:
{ "code": "mwoauth-invalid-authorization", "text": "The authorization headers in your request are not valid: Invalid access token", }
- Get a new access token through rest.php/oauth2/access_token using the stored refresh token. You successfully receive a new refresh and access token.
- Try to edit the wiki using the new access token. It fails with below error:
{ "code": "mwoauth-invalid-authorization", "text": "The authorization headers in your request are not valid: Cannot create access token, user did not approve issuing this access token", }
What happens?:
The OAuth2 consumer is able to get new access tokens despite the authorization being revoked.
Both errors when using the access tokens having the same error code also makes it very hard to differentiate between an invalid token and revoked authorization.
What should have happened instead?:
The request to rest.php/oauth2/access_token should have returned an error due to the consumers authorization being revoked. (Invalid refresh token)
See also https://www.oauth.com/oauth2-servers/making-authenticated-requests/refreshing-an-access-token/
Keep in mind that at any point the user can revoke an application , so your application needs to be able to handle the case when using the refresh token also fails. At that point, you will need to prompt the user for authorization again, beginning a new OAuth flow from scratch.
Software version:
MediaWiki 1.39.3 (469b9cb)
OAuth 1.1.0 (28d55e5)
Other information:
Used OAuth2 consumer: https://wikibot.miraheze.org/wiki/Special:OAuthListConsumers/view/f7d7b6d85767eb1b443f283b63d46d5b
Access tokens are removed at Control/ConsumerAcceptanceSubmitControl.php#L223, however refresh tokens stay unchanged.