How to revoke an authentication token client side against the Google Api

Question

I am trying to revoke a token using the Google Api client side code.

My code looks something like this:

$.get("https://accounts.google.com/o/oauth2/revoke?token=" + accessToken, function () {
        window.location.reload();
    });

And I am getting the following error?

XMLHttpRequest cannot load https://accounts.google.com/o/oauth2/revoke?token=tokenishere Origin http://balblabla.com is not allowed by Access-Control-Allow-Origin.

Based on the error it looks like you cannot do this on this client. Perhaps you'll need a server-side script to handle the request from within your domain. You can also explore [this](http://stackoverflow.com/questions/3506208/jquery-ajax-cross-domain) solution. Here's a [jsFiddle](http://jsfiddle.net/hwjPS/) example using the solution. — krg, Oct 09 '12 at 22:30

score 5 · Answer 1 · edited Oct 01 '15 at 02:57

5

After some research I found out that you can get around the cors restriction by specifying a dataType: 'jsonp' option in your jquery ajax request. The relevant info is here: https://developers.google.com/+/web/signin/disconnect

$.ajax({
  type: 'GET',
  url: revokeUrl,
  async: false,
  contentType: "application/json",
  dataType: 'jsonp',
  success: function(nullResponse) {
    // Do something now that user is disconnected
    // The response is always undefined.
  },
  error: function(e) {
    // Handle the error
    // console.log(e);
    // You could point users to manually disconnect if unsuccessful
    // https://plus.google.com/apps
  }
});

edited Oct 01 '15 at 02:57

Evan Siroky

9,040
6
54
73

answered Oct 06 '13 at 04:19

StrangeLooper

549
5
11

2

This works great, but is there a way to do it without jquery? – mhatch Apr 13 '17 at 18:22
The link is 404 – Aidin Aug 29 '22 at 16:49

score 1 · Accepted Answer · edited Jul 29 '17 at 14:23

Following on from @krg's comment:

Based on the error it looks like you cannot do this on this client. Perhaps you'll need a server-side script to handle the request from within your domain. You can also explore this solution. Here's a jsFiddle example using the solution.

I have done this on the server side, using the same code:

$.ajax({
     url:"https://accounts.google.com/o/oauth2/revoke?token=10100101",
     dataType: 'jsonp', // Notice! JSONP <-- P (lowercase)
     success:function(json){
         console.log(arguments);
         // do stuff with json (in this case an array)
         alert("Success");
     },
     error:function(){
         alert("Error");
     },
});

which works.

score 0 · Answer 3 · answered Nov 16 '19 at 18:28

Now jsonp does not work. They have change content type to "application/x-www-form-urlencoded",

    $.ajax({
        type: 'GET',
        url: "https://accounts.google.com/o/oauth2/revoke?token=dsfgdfsg.98sdfgsdfg9sd8fgsdfgs.sdfg89dsfg",
        async: false,
        contentType: "application/x-www-form-urlencoded",
        success: function(nullResponse) {
            // Do something now that user is disconnected
            // The response is always undefined.
        },
        error: function(e) {
            console.log(e)
        }
    });

How to revoke an authentication token client side against the Google Api

3 Answers3

Linked