Spring 云 oauth2 启用撤销令牌端点

Question

I need revoke token endpoint. It seems absent in spring framework, so I've added custom one. There are added two methods ( GET , DELETE ) with the same functionality (to play with that):

@FrameworkEndpoint
@RequestMapping(
    value = {"oauth"},
    produces = MediaType.APPLICATION_JSON_VALUE
)
@Validated
public class RevokeTokenEndpoint {

  @Autowired
  private DefaultTokenServices tokenServices;

  @ResponseStatus(HttpStatus.NO_CONTENT)
  @GetMapping(value = "revoke")
  public void revokeToken(HttpServletRequest request) {
    String authorization = request.getHeader("Authorization");
    if (authorization != null && authorization.contains("Bearer")) {
      String tokenId = authorization.substring("Bearer".length() + 1);
      tokenServices.revokeToken(tokenId);
    }
  }

  @ResponseStatus(HttpStatus.ACCEPTED)
  @DeleteMapping(value = "revoke")
  public void revokeToken(Authentication authentication) {
    tokenServices.revokeToken(((OAuth2AuthenticationDetails) authentication
        .getDetails()).getTokenValue());
  }
}

If I try GET method, token is revoked successfully:

curl -X GET -H "Authorization: Bearer e7683428-d06b-429a-9e76-91df9521c897" "http://localhost:8082/oauth/revoke"

2019-08-22 14:26:37.814 DEBUG o.s.w.s.DispatcherServlet - Completed 204 NO_CONTENT

in DELETE method case - no:

2019-08-22 14:28:53.551 DEBUG o.s.b.a.a.l.AuditListener - AuditEvent [timestamp=2019-08-22T11:28:53.550Z, principal=anonymousUser, type=AUTHORIZATION_FAILURE, data={details=org.springframework.security.web.authentication.WebAuthenticationDetails@ffff4c9c: RemoteIpAddress: 0:0:0:0:0:0:0:1; SessionId: A8B4925366067778DC83CDE4066F1A62, type=org.springframework.security.access.AccessDeniedException, message=Access is denied}] 

Question

Is there any recommendations how to make working oauth/revoke endpoint for the DELETE method (resolve AUTHORIZATION_FAILURE issue)?

More Details

Please be informed, I tried similar functionality to GET for DELETE method also.

My security restrictions are:

@Override
protected void configure(HttpSecurity http) throws Exception {
  http
      .authorizeRequests()
      .antMatchers("/actuator/**", "/oauth/revoke")
      .permitAll()
      .anyRequest()
      .authenticated();
}

Answer 1

Try using as path /oauth/token instead, eg:

@ResponseStatus(HttpStatus.ACCEPTED)
@DeleteMapping(value = "token")
public void revokeToken(Authentication authentication) {
  tokenServices.revokeToken(((OAuth2AuthenticationDetails) authentication
      .getDetails()).getTokenValue());
}