Level up your Box knowledge with brand new learning paths on Box University. Visit training.box.com to get started

Box Status

Removing app does not revoke refresh token

Follow
New post
Maxime Beaudoin
  • Edited

After removing a custom app from my user account, I can still use the refresh token and access everything. Essentially, removing an app does not revoke permissions. Why? This is a huge security concern.

0

Comments

1 comment

Date Votes
  • Alex Novotny

    Hi, 

    Can you send me the client id of that application or the enterprise id the app is tied to? It looks like the account that posted this question is not tied to an enterprise.

    Thanks, 

    Alex, Box Developer Advocate

    0
    Comment actions Permalink

Post is closed for comments.