React-native-app-auth: Still keep cookies after signout

[lequangnguyenqn]

Hi!

I'm using my Identity Server 4. But it's not work correctly, i'm still authenticated from Identity Server after logout.
But it's working with your configure: https://github.com/FormidableLabs/react-native-app-auth#identity-server-4
After i changed to your configure "https://demo.identityserver.io" then it work with my code.

So i'm wonder why it's working in your setup? do we have special config in you Identity Server 4 or Reac native app. Do you clear cookies after signout? i see the code just call to /connect/revocation. Or do you login which is open new webview in incognito mode?

[kadikraman]

I'm not 100% sure what could be different. We use their native.code config with PKCE, the code for the config is public here.

The revoke function doesn't have any native bindings, we simply call the revocation endpoint defined in the discovery endpoint

Only thing I can think of is Identity Server required client id being sent to the revocation endpoint.
Did you add sendClientId: true in revoke?

await revoke(config, {
  tokenToRevoke: refreshedState.refreshToken,
  sendClientId: true
});

[lequangnguyenqn]

Hi again,

Yes, i set sendClientId to true. It's call the revocation endpoint successfully. And i also tried to use Postman to manual call to that endpoint.
But after i click on login button again, it went to Identity Server, that site remember that i did signin already and redirect back to my app.

am i missing the configure in my React Native app? something like open the webview with disable cookie, or clear cookie after call to revocation endpoint. But i do not find that code.

Can you show me how the example delete the cookies? when it clear the cookies in webview?

Thanks so much.

[lequangnguyenqn]

I'm not sure that the site https://demo.identityserver.io/ contain some custom code or not. Because i took the code from Github at https://github.com/IdentityServer/IdentityServer4.Demo which they said the source code for demo.identityserver.io site. But i could not make it work in my localhost.

Finally, I found a way to solve this. I did a custom code to override DefaultUserSession:
`
public class CustomUserSession : DefaultUserSession
{

    /// <summary>
    /// Initializes a new instance of the <see cref="DefaultUserSession"/> class.
    /// </summary>
    /// <param name="httpContextAccessor">The HTTP context accessor.</param>
    /// <param name="schemes">The schemes.</param>
    /// <param name="handlers">The handlers.</param>
    /// <param name="options">The options.</param>
    /// <param name="clock">The clock.</param>
    /// <param name="logger">The logger.</param>
    public CustomUserSession(
        IHttpContextAccessor httpContextAccessor,
        IAuthenticationSchemeProvider schemes,
        IAuthenticationHandlerProvider handlers,
        IdentityServerOptions options,
        ISystemClock clock,
        ILogger<IUserSession> logger):
        base (httpContextAccessor, schemes, handlers, options, clock, logger)
    {
    }

    /// <summary>
    /// Gets the current authenticated user.
    /// </summary>
    /// <returns></returns>
    public override async Task<ClaimsPrincipal> GetUserAsync()
    {
        if (HttpMethods.IsGet(HttpContext.Request.Method))
        {
            StringValues clientStringValues;
            HttpContext.Request.Query.TryGetValue(OidcConstants.AuthorizeRequest.ClientId, out clientStringValues);
            if(clientStringValues.Count > 0 && 
                HttpContext.Request.Path == "/connect/authorize" && 
                clientStringValues[0] == "native.code")
            {
                return null;
            }
        }
        return await base.GetUserAsync();
    }
}`

And then override the default one:
services.AddScoped<IUserSession, CustomUserSession>();

Hope it will help for any one that get same problem as me!

[kadikraman]

Glad you got it working and thanks a lot for also posting your solution 🙏

[rekha-emids]

Hi,
Revoke method is not clearing session in mobile.