[Chromoting] The webapp revokes OAuth refresh tokens when they will no longer be used.

remoting/webapp/oauth2.js

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 /**
  * @fileoverview
  * OAuth2 class that handles retrieval/storage of an OAuth2 token.
  *
  * Uses a content script to trampoline the OAuth redirect page back into the
  * extension context.  This works around the lack of native support for
@@ skipping 10 matching lines @@
 
 
 /** @constructor */
 remoting.OAuth2 = function() {
 };
 
 // Constants representing keys used for storing persistent state.
 /** @private */
 remoting.OAuth2.prototype.KEY_REFRESH_TOKEN_ = 'oauth2-refresh-token';
 /** @private */
+remoting.OAuth2.prototype.KEY_REFRESH_TOKEN_REVOKABLE_ =
+    'oauth2-refresh-token-revokable';
+/** @private */
 remoting.OAuth2.prototype.KEY_ACCESS_TOKEN_ = 'oauth2-access-token';
 /** @private */
 remoting.OAuth2.prototype.KEY_EMAIL_ = 'remoting-email';
 
 // Constants for parameters used in retrieving the OAuth2 credentials.
 /** @private */
 remoting.OAuth2.prototype.SCOPE_ =
       'https://www.googleapis.com/auth/chromoting ' +
       'https://www.googleapis.com/auth/googletalk ' +
       'https://www.googleapis.com/auth/userinfo#email';
 /** @private */
 remoting.OAuth2.prototype.OAUTH2_TOKEN_ENDPOINT_ =
     'https://accounts.google.com/o/oauth2/token';
-
+/** @private */
+remoting.OAuth2.prototype.OAUTH2_REVOKE_TOKEN_ENDPOINT_ =
+    'https://accounts.google.com/o/oauth2/revoke';
 /** @return {boolean} True if the app is already authenticated. */
 remoting.OAuth2.prototype.isAuthenticated = function() {
-  if (this.getRefreshToken()) {
+  if (this.getRefreshToken_()) {
     return true;
   }
   return false;
 };
 
 /**
  * Removes all storage, and effectively unauthenticates the user.
  *
  * @return {void} Nothing.
  */
 remoting.OAuth2.prototype.clear = function() {
-  window.localStorage.removeItem(this.KEY_REFRESH_TOKEN_);
   window.localStorage.removeItem(this.KEY_EMAIL_);
   this.clearAccessToken();
+  this.clearRefreshToken_();
 };
 
 /**
+ * Sets the refresh token.
+ *
+ * This method also marks the token as revokable, so that this object will
+ * revoke the token when it no longer needs it.
+ *
  * @param {string} token The new refresh token.
  * @return {void} Nothing.
  */
 remoting.OAuth2.prototype.setRefreshToken = function(token) {
   window.localStorage.setItem(this.KEY_REFRESH_TOKEN_, escape(token));
+  window.localStorage.setItem(this.KEY_REFRESH_TOKEN_REVOKABLE_, true);
   this.clearAccessToken();
 };
 
-/** @return {?string} The refresh token, if authenticated, or NULL. */
-remoting.OAuth2.prototype.getRefreshToken = function() {
+/**
+ * Gets the refresh token.
+ *
+ * This method also marks the refresh token as not revokable, so that this
+ * object will not revoke the token when it no longer needs it. After this
+ * object has exported the token, it cannot know whether it is still in use
+ * when this object no longer needs it.
+ *
+ * @return {?string} The refresh token, if authenticated, or NULL.
+ */
+remoting.OAuth2.prototype.exportRefreshToken = function() {
+  window.localStorage.removeItem(this.KEY_REFRESH_TOKEN_REVOKABLE_);
+  return this.getRefreshToken_();
+};
+
+/**
+ * @return {?string} The refresh token, if authenticated, or NULL.
+ * @private
+ */
+remoting.OAuth2.prototype.getRefreshToken_ = function() {
   var value = window.localStorage.getItem(this.KEY_REFRESH_TOKEN_);
   if (typeof value == 'string') {
     return unescape(value);
   }
   return null;
 };
 
 /**
+ * Clears the refresh token.
+ *
+ * @return {void} Nothing.
+ * @private
+ */
+remoting.OAuth2.prototype.clearRefreshToken_ = function() {
+  if (window.localStorage.getItem(this.KEY_REFRESH_TOKEN_REVOKABLE_)) {
+    this.revokeToken_(this.getRefreshToken_());
+  }
+  window.localStorage.removeItem(this.KEY_REFRESH_TOKEN_);
+  window.localStorage.removeItem(this.KEY_REFRESH_TOKEN_REVOKABLE_);
+};
+
+/**
  * @param {string} token The new access token.
  * @param {number} expiration Expiration time in milliseconds since epoch.
  * @return {void} Nothing.
  */
 remoting.OAuth2.prototype.setAccessToken = function(token, expiration) {
   var access_token = {'token': token, 'expiration': expiration};
   window.localStorage.setItem(this.KEY_ACCESS_TOKEN_,
                               JSON.stringify(access_token));
 };
 
@@ skipping 100 matching lines @@
  * @return {void} Nothing.
  */
 remoting.OAuth2.prototype.refreshAccessToken = function(onDone) {
   if (!this.isAuthenticated()) {
     throw 'Not Authenticated.';
   }
 
   var parameters = {
     'client_id': this.CLIENT_ID_,
     'client_secret': this.CLIENT_SECRET_,
-    'refresh_token': this.getRefreshToken(),
+    'refresh_token': this.getRefreshToken_(),
     'grant_type': 'refresh_token'
   };
 
   /** @type {remoting.OAuth2} */
   var that = this;
   /** @param {XMLHttpRequest} xhr The XHR reply. */
   var processTokenResponse = function(xhr) {
     that.processTokenResponse_(xhr);
     onDone(xhr);
   };
@@ skipping 43 matching lines @@
   var processTokenResponse = function(xhr) {
     that.processTokenResponse_(xhr);
     onDone(xhr);
   };
   remoting.xhr.post(this.OAUTH2_TOKEN_ENDPOINT_,
                     processTokenResponse,
                     parameters);
 };
 
 /**
+ * Revokes a refresh or an access token.
+ *
+ * @param {string?} token An access or refresh token.
+ * @return {void} Nothing.
+ * @private
+ */
+remoting.OAuth2.prototype.revokeToken_ = function(token) {
+  if (!token || (token.length == 0)) {
+    return;
+  }
+  var parameters = { 'token': token };
+
+  /** @param {XMLHttpRequest} xhr The XHR reply. */
+  var processResponse = function(xhr) {
+    if (xhr.status != 200) {
+      console.log('Failed to revoke token. Status: ' + xhr.status +
+                  ' response: ' + xhr.responseText);

[Jamie, 2012/04/16 17:04:45]

I think I'd probably log the xhr object itself here as well, in case any of the
other fields are useful.

[simonmorris, 2012/04/16 22:37:51]

Done.

+    }
+  };
+  remoting.xhr.post(this.OAUTH2_REVOKE_TOKEN_ENDPOINT_,
+                    processResponse,
+                    parameters);
+};
+
+/**
  * Call myfunc with an access token as the only parameter.
  *
  * This will refresh the access token if necessary.  If the access token
  * cannot be refreshed, an error is thrown.
  *
  * The access token will remain valid for at least 2 minutes.
  *
  * @param {function(string):void} myfunc
  *        Function to invoke with access token.
  * @return {void} Nothing.
@@ skipping 53 matching lines @@
  * @return {?string} The email address, if it has been cached by a previous call
  *     to getEmail, otherwise null.
  */
 remoting.OAuth2.prototype.getCachedEmail = function() {
   var value = window.localStorage.getItem(this.KEY_EMAIL_);
   if (typeof value == 'string') {
     return value;
   }
   return null;
 };