{"action":"opened","issue":{"url":"https://api.github.com/repos/robisim74/Angular2SPAWebAPI/issues/9","repository_url":"https://api.github.com/repos/robisim74/Angular2SPAWebAPI","labels_url":"https://api.github.com/repos/robisim74/Angular2SPAWebAPI/issues/9/labels{/name}","comments_url":"https://api.github.com/repos/robisim74/Angular2SPAWebAPI/issues/9/comments","events_url":"https://api.github.com/repos/robisim74/Angular2SPAWebAPI/issues/9/events","html_url":"https://github.com/robisim74/Angular2SPAWebAPI/issues/9","id":204736235,"number":9,"title":"Sign out functionality not working correctly","user":{"login":"pwen090","id":19834208,"avatar_url":"https://avatars.githubusercontent.com/u/19834208?v=3","gravatar_id":"","url":"https://api.github.com/users/pwen090","html_url":"https://github.com/pwen090","followers_url":"https://api.github.com/users/pwen090/followers","following_url":"https://api.github.com/users/pwen090/following{/other_user}","gists_url":"https://api.github.com/users/pwen090/gists{/gist_id}","starred_url":"https://api.github.com/users/pwen090/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pwen090/subscriptions","organizations_url":"https://api.github.com/users/pwen090/orgs","repos_url":"https://api.github.com/users/pwen090/repos","events_url":"https://api.github.com/users/pwen090/events{/privacy}","received_events_url":"https://api.github.com/users/pwen090/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2017-02-01T23:20:27Z","updated_at":"2017-02-01T23:20:27Z","closed_at":null,"body":"Hello, first thank you so much for your effort on this sample project.\r\n\r\nI was reviewing it as in my own implementation of Angular+IdentityServer I am having trouble making the Sign Out functionality fully sign out a user and I was hoping this project was doing that successfully but it seems it suffers the same issue.\r\n\r\nWhen you sign in the server returns a Bearer token to use for subsequent api requests say to the value api. When you sign out the app is sending two requests to /connect/revocation one to revoke the access_token and the other to revoke the refresh_token. These both return 200 as to indicate success however someone with the Bearer token can still login after these two revocations have been called.\r\n\r\nYou can reproduce this by logging in to the app; grab the bearer token with chrome, make a request with that token to the /api/values with something like Postman and include the Bearer token. You will see that even after Log Out you can still successfully use that token meaning it has not actually be revoked. \r\n\r\nThis is the same issue I am having in my own project and I was wondering if you are aware of this issue and know of any fix to make your Angular2SPAWebAPI successfully Log Out so that tokens can not be reused after the fact? thank you. "}}
{"actor":{"display_login":"pwen090"}}