Revoking an accessToken using UnauthorizedError does not work

Question

I have been trying to create an Action on Google app and wanted to have a login so that users can perform actions on my app outside the Google assistant flow and then return back to the assistant flow, since it is easier to configure my application with a proper UI.

I am using Google Sign In and OAuth in implicit mode.

All my tests are done using the simulator, and I am not sure if my problem is related to that fact or not.

In the "auth" path I was able to get a signed token by redirecting myself to:

req.query.redirect_uri + '#access_token=' + my_generated_token + '&token_type=bearer&state=' + req.query.state

Notice the evil # (before the access_token) instead of the ?. Using ? did not work and requested me to add code or error fields which are not mentioned in the SDK. Moreover, adding code=1 or code=200 or code=0 did not help either.

Changing to # did the trick. Although my "token" path was never checked by Google before it was approved which was weird. Would love to know why...

The problem now is that the conversation is always coming with that token and I cannot seem to get it revoked.

I tried returning 401 response very early using:

app.use((req, res, next) => {
    console.log("revoke token");
    res.status(401);
    res.set('Content-Type', 'application/json;charset=UTF-8');
    res.send({"error":"user_not_found"});
});

and I tried using the rather new UnauthorizedError from 'actions-on-google' API by creating an intent in dialogflow (with no responses) and invoking it from the simulator:

app.intent('sign_out', conv => {
    console.log("sign_out");
    console.log(conv.user);
    throw new UnauthorizedError();
});

In every case I see the server returns 401 in the logs:

POST / 401 12.532 ms - 2

The assistant then responds that the app is no longer responding and I always get the accessToken the next time I invoke my app from the simulator, meaning it is not revoked. The accessToken is the one I generated in the redirect params and it never changes. My "auth" and "token" handlers (as defined in the console for Account Linking) are also never called since the token was passed to the conversation JSON.

Also, thought I would mention, I am using NGINX reverse proxy to direct the calls to my server (since I have multiple services: DB, server and client). The NGINX is configured with let's encrypt SSL.

I saw multiple threads where it was claimed that UnauthorizedError is working. For example: https://github.com/actions-on-google/actions-on-google-nodejs/issues/289

Anyone can help please? I don't know why Actions on Google refuses to revoke my token.

Revoking an accessToken using UnauthorizedError does not work

0 Answers