0

I am using the OAuth2 authorization code grant with the Simple OAuth module. Everything is working, however I would like to be able to validate access and refresh tokens from my frontend NodeJS server. Is there an API endpoint to which I can send a token to, and in the response I get information about that token (aka token introspection)? For example, a response telling me the token is expired.

Thanks for all the help in advance, and let me know if I need to clarify the question in any way!

6
  • The question is how to validate JavaScript Web Tokens on other web apps. Do I have that right?
    – cilefen
    Jan 29, 2023 at 23:44
  • @cilefen Not quite. I want to validate access tokens I've received from Drupal/Simple OAuth module. I receive an authorization token after the user logs in. I can then exchange that for an access token and refresh token. I want to validate the access and refresh token. Jan 30, 2023 at 1:45
  • OAuth sends validity times with the tokens. But you wish to test them further without making an ordinary API call (like a request for some data with the access token), or request a new access token (with the refresh token), correct? The question is whether or not OAuth requires a validation API, does this module provide one, yes?
    – cilefen
    Jan 30, 2023 at 12:04
  • @cilefen That is precisely correct. I'm hoping there is a separate API call only for token validation. Jan 30, 2023 at 14:11
  • 1
    The routes in that module are git.drupalcode.org/project/simple_oauth/-/blob/5.2.x/… and the implementable OAuth 2.0 endpoints are documented in this RFC: rfc-editor.org/rfc/rfc6749.
    – cilefen
    Jan 30, 2023 at 15:52

1 Answer 1

1

I am fairly sure the answer is "no". There is no such route provided by the module.

At this stage this looks like a feature request for the module.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.