spring - Delete access_token after logout -

i have little question.

at moment spring configuration uses defaulttokenservices (provided spring-security-oauth2-2.0.0.m3.jar). generates correctly access_token.

now cancel/delete/remove/revoke token when logout.

in security.xml configured logout in http tag:

<sec:logout logout-url="/logout" logout-success-url="/auth" invalidate-session="true" delete-cookies="true" />

and redirection successfully. if write test doing login, logout , after try access restricted path access_token can successful request, expect not authorized error. why?

how can configure logout access_token automatically deleted force new login?

the lifetime of access_token independent of login session of user grants access client. oauth2 has no concept of user login or logout, or session, fact expect logout revoke token, seem indicate you're misunderstanding how oauth2 works. should clarify in question why want things work way , why need oauth.

if want behaviour, have code (in custom spring security logouthandler, example), lifetime of token governed expiry time. token revocation separate interface provided user, allowing them prematurely revoke access resources 1 or more clients - twitter's third-party applications access.