React-native-auth0: Can't logout on Android

[anderslemke]

I'm using WebAuth, and once logged in, there is no way to logout again?

I'm aware that clearSession is not working, so I would expect auth0.auth.authorize() to give me a "fresh" starting point where I can log in. But it just logs me in with the previously logged in user.

So; in practice you can't log out on Android. Is this correct?

[cocojoe]

As it stands there is no solution for this other than manually logging of the social provider in the browser to clear the SSO.

[anderslemke]

OK.
I'm not using a social provider though. I'm using email/password. I.e. the Database connection.

[cocojoe]

Sorry, your question was I'm using WebAuth, and once logged in, there is no way to logout again?

[anderslemke]

I saw the discussion in #109 about the social connections, which kind of makes sense.

To me, it seems that the problem is with the Lock, that automatically logs the user in, without prompting at all.

It's the same behavior on iOS.

I would expect it to at least prompt me with something, and not just doing the redirect.

That's the behavior when I visit the hosted page in a browser; https://zetland.eu.auth0.com/login?client=r1rqGARLMNqpqeM7pSHEprMMFF7xk7oK

Could you help me shed some light on, why the behavior of the hosted page, is different in the browser (Firefox in my case) and in the app (i.e. in-app-browser)?

[cocojoe]

@anderslemke You can also try passing the key prompt with value login in your WebAuth options when you want to force a login. Instead of clearSession, this will also work in Android.

[evansiroky]

How exactly does one set the prompt to login? Here is what I have right now:

const nonce = uuid()

const authParams = {}
authParams.nonce = nonce
authParams.scope = 'email offline_access openid profile'

if (Platform.OS === 'android') {
  authParams.prompt = 'login'
}

auth0
  .webAuth
  .authorize(authParams)
  .then(...)
  .catch(...)

This method is not working at all for me and the chrome website is always returning a successful login each time and it completely skips the screen for a user to confirm to use their last used login.

[lbalmaceda]

@evansiroky You're setting the prompt parameter fine. AFAIK the expected behavior of what @cocojoe said is that the login form (lock) is shown every time instead of reaching the "Last time you logged in using.." screen or even having the browser auto-login.

[evansiroky]

I cloned the auth0-react-native-sample project and made a test tenant to come up with something reproducible. It looks like the problem is a result of me turning off the "OIDC Conformant" switch of the client in the OAuth section of the advanced settings. When this is off, the lock widget does weird things even when the prompt parameter is set.

[lbalmaceda]

I strongly encourage you to ask for this on https://support.auth0.com since this is not an SDK issue.