React-native-auth0: Webauth logout doesn't truly log you out

[dvermeirImec]

I followed the documentation exactly (and even copied some of the code from the example project) but whatever I do, logging out doesn't seem to truly log you out.

The lock page seems to remember the last logged in user (which is fine) but when I select "Not my user account" and get an overview of all the enabled social providers again, no matter what I do it always logs in with the last authenticated account for the provider.

To give an example this is the logout code:

if (Platform.OS === 'ios') {
      new Auth0({
        domain: getConfig().auth0.domain,
        clientId: getConfig().auth0.clientId,
      }).webAuth
        .clearSession()
        .then(() => {
          this.props.logoutSuccess();
        })
        .catch(err => {
          this.props.logoutError(err);
          console.log(err);
        });
    } else {
      this.props.logoutSuccess();
    }

On logoutSuccess we also clear all the tokens (refresh, auth, id,...) from Redux.
The behaviour is the same on iOS and on Android.

How can I enable a user to log in with a different account after logout using the Lock screen?

I'm using react-native-auth0 1.2.1 btw.

[cocojoe]

Hi @dvermeirImec can I check which provider you are trying to log out from? In your case above you should try supplying the federated true flag.

https://github.com/auth0/react-native-auth0/blob/d52191429288fb6f1a2a1e83f371a45fe0ab366c/docs/webauth_index.js.html#L146

Also in regard to Android there is no clearSession functionality this is due to inconsistent Android Browser behaviour as we have tested this multiple times.

Thanks

[dvermeirImec]

Hi,

I'm testing this right now with the Facebook provider. Won't the federated flag also log you out of the Facebook app for example?

Does this mean that for Android, once you've logged in with a Facebook account once, there's no way to ever log in with a different Facebook account?

[dvermeirImec]

Sure,

I've got an Auth0 account with the Facebook identity provider enabled (no other way to log in).

I used the sample project in my example, just downloaded it and set the auth-credentials to my client.

I added "com.auth0sample://foo.eu.auth0.com/android/com.auth0sample/callback" and "com.auth0sample://foo.eu.auth0.com/ios/com.auth0sample/callback" to my Allowed Callback urls.

Then I ran the project on a device (Google Pixel and iPhone 6). The result is the same on both.

Steps to reproduce in the Sample project:

1) Run the app

2) Click log in (a webview with the Lock screen opens)

3) Click "Log in with Facebook"

4) Enter Facebook credentials, and click accept in the permissions prompt

5) A popup shows the acces token

6) Click log out

7) Click log in (a webview opens showing "You were last logged in with: Foo"

8) Click "Not my user account" (The webview shows the "Log in with Facebook" button again)

9) Click "Log in with Facebook"

10) The app show a popup with a new acces token <== bug

[cocojoe]

Federated does not log you out of the iOS FB Application.
Remember this all works through Web Authentication so you are logged in via the browser, so to log out, it is the browser that requires the cookies to be removed.

I am interested in what your use case is that requires multiple social log in/outs on mobile devices, as typically devices are personal?

Android
The only way is to log out from an already logged in fb account, you need open the browser used for authentication (Chrome for example when using custom tabs) and log out manually from the fb site.
Because the authentication is delegated to the browser, we can’t remove that cookie.

iOS
You can of course open Safari and navigate to facebook.com and Log out.
Federated logout should log you out of the providers. However, there is one caveat here that FB requires the FB AT to logout. However, a native client does not have access to this AT.
(I am discussing this internally just now)

[dvermeirImec]

Hi,

you are correct in saying that mobile devices are usually personal devices. We have some use cases where this is not the case however (test devices for our imec Living Labs department, developer devices,...).

In any case I believe it's not expected behaviour when you "Log out" of an application that anyone can auto-login without authenticating but that's a matter of debate.

So the gist for a crossplatform solution is, if we really want to log out the user and force reauthentication we can't use the Lock screen but have to develop our own screen and use the Auth0 API?

[cocojoe]

There is no reliable cross platform solution unfortunately or we would have implemented it.
Creating your own screen doesn't provide any benefit, the screen itself is not the issue, it is only a UI.

OAuth authentication occurs via the Browser, the browser will store cookies. This provides the convenience of SSO for the end user. If a users already logged into FB via their browser and opened up your app, then selected Facebook connection, they would be taken straight in and do not have to enter their username/password as they have already authenticated and a cookie is present.

The issue is being able to remove these cookies from the browser to effectivley "logout" a user.

[matejukmar]

Is there any solution for this?
I tried to do 'federated log out' + log out from Facebook in Safari browser on the iPhone + log out from Facebook app on the phone (all this together), but Facebook is still 'logged in' Auth0's SFSafariViewController, and there is no way to log in with different account.

[cocojoe]

In authorize you can force the IdP (Identity Provider) to login again using prompt=login. So rather than logout on next login try

.authorize({
        scope: 'openid profile',
        audience: 'https://' + credentials.domain + '/userinfo',
        prompt: 'login'
})

This is native platform independent.

[joshspicer]

Thank you @cocojoe!

[sroze]

~It does not seem to work with the auth0.webAuth.authorize method~ All you need to do with the webAuth is to call the clearSession method ❤️

[devpascoe]

I had issues with this on iOS.
auth0.webAuth
.authorize({
audience: 'https://myaudienceurl',
scope: 'openid profile email offline_access',
connection: 'facebook',
prompt: 'login'
})

So when the prompt:login was specified i could log in and the callback worked however ONLY for my fb account which belonged as an admin to the FB app. But for normal users just got an empty callback white screen and never redirected back to the app.

If i removed prompt: 'login' it works fine for normal fb users ... but now once selected you cannot see the prompt anymore logging in and out, then back in. And my logout is auth0.webAuth.clearSession()

[devpascoe]

Is there any solution for this?
I tried to do 'federated log out' + log out from Facebook in Safari browser on the iPhone + log out from Facebook app on the phone (all this together), but Facebook is still 'logged in' Auth0's SFSafariViewController, and there is no way to log in with different account.

did you find a solution for logging out of FB @matejukmar ?

[andreasvirkus]

@sroze the clearSesssion is not a documented method - do you know if it's still in use?