hn • r/hackernews
Comment on: Malware abuses Google OAuth endpoint to 'revive' cookies, hijack accounts
> Revoking a bearer token for multiple services is an open loop problem, where you can't know if all services...What is a service here? A bearer token is meant solely for the AS. Revocation of a bearer token only means something in the context of the AS.Now if one wants to build some AS feature to go tell every protected resource "there's an access token good for another 15 minutes - I revoked its bearer token so don't honor that access token" one can build such a thing, but it is going to be some particular custom aspect of the implementation shared between the AS and resource servers.Since O