I have a question about signing out users securely with Google Identity Platform.
I am using the firebase-js-sdk to manage the sign in of my Google Identity Platform users. However signout only clears session storage, it does not invalidate refresh tokens. I thought — perhaps incorrectly — that it wouldn’t be safe to have ‘dangling’ refresh tokens (which if issued from GIP are good for roughly 200 days).
Is there a reason why Google doesn't invalidate refresh tokens from the client?