Solved: Need help interpreting cascade on InvalidateToken - Page 2

Report Inappropriate Content · 06-22-2015 01:12 PM

I'm looking at http://apigee.com/docs/api-services/content/validating-and-invalidating-access-tokens and am hoping someone can help clarify the cascade option. I have bolded two statements that appear to be conflicting. The top section seems to indicate that you cannot use a refresh token once the access token has been revoked. The bottom section says that the cascade parameter controls that. So it seems that cascade=false will not revoke the refresh token but it can't be used. What am I missing? Thanks.

Doc text:

Token expiration is independent of the state of the token (approved or revoked). If you revoke an access token, its associated refresh token cannot be used to refresh the revoked access token.

...

cascade (optional, boolean): By default, this option is set to true, and causes the revocation to propagate to associated tokens. So, if applied to a refresh token, its associated access token is also revoked. If applied to an access token, its associated refresh token is also revoked. If you set this tofalse, then only the specified access or refresh token is revoked.

willwitman

@Jeff Nadeau After a little checking, I confirmed that the first note you refer to above was worded incorrectly. The correct wording is below. The doc has been updated. Otherwise, the description of "cascade" is correct. That was a good catch -- thanks for raising the question.

"Token expiration is independent of the state of the token (approved or revoked). If a refresh token has expired, you cannot use it to refresh an access token."

View solution in original post