Merge pull request #839 from mattermost/revoke-token

Properly revoke OAuth sessions when revoking all user sessions.

api/user.go

@@ -466,6 +466,9 @@ func RevokeAllSession(c *Context, userId string) {
 
 		for _, session := range sessions {
 			c.LogAuditWithUserId(userId, "session_id="+session.Id)
+			if session.IsOAuth {
+				RevokeAccessToken(session.Token)
+			} else {
 				sessionCache.Remove(session.Token)
 				if result := <-Srv.Store.Session().Remove(session.Id); result.Err != nil {
 					c.Err = result.Err
@@ -473,6 +476,7 @@ func RevokeAllSession(c *Context, userId string) {
 				}
 			}
 		}
+	}
 }
 
 func getSessions(c *Context, w http.ResponseWriter, r *http.Request) {