Removing app does not revoke refresh token

Follow

New post

Maxime Beaudoin

• February 01, 2022 18:20
• Edited

After removing a custom app from my user account, I can still use the refresh token and access everything. Essentially, removing an app does not revoke permissions. Why? This is a huge security concern.

0

• 

  Alex Novotny

  • February 02, 2022 16:42

  Hi, 

  Can you send me the client id of that application or the enterprise id the app is tied to? It looks like the account that posted this question is not tied to an enterprise.

  Thanks, 

  Alex, Box Developer Advocate

  0

  Comment actions Permalink

Post is closed for comments.