As of October 5, automatic OAuth 2.0 token revocation upon password reset

Google has finally announced a new OAuth 2.0 token revocation according to its security policy, the company will roll out the change starting on Oct. 5.

The change to the Google security policy was announced last year by Google, the company explained that OAuth 2.0 tokens would be revoked when a user’s password was changed.

The company has implemented the OAuth 2.0 authentication protocol in 2012 with the intent of boosting the security of its services like Gmail and Google Talk.

Google aims to improve users’ security limiting the impact on the usability of its application, at least in this first phase so although initially planned for a wider set of applications, the OAuth 2.0 token revocation rule will be limited to the email mail service.

Google confirmed that the App Script tokens and apps installed via the Google Apps Marketplace are not subject to the token revocation.

The change will impact also mobile users, it will affect for example mail applications. The Apple iOS users who use the mail application included in the mobile OS will have to re-authorize it with their Google account credentials when they change their password.

This is nothing new for Gmail apps on both iOS and Android the already require to grant a new OAuth 2.0 token upon password reset, but Google will enforce the change also to third-party apps.

For further information on the new OAuth 2.0 token revocation rule give a look at the post published by Google that includes also a list of FAQ

[adrotate banner=”9″]

Pierluigi Paganini

(Security Affairs – OAuth 2.0, security policy)