Credentials are cached in mobile browsers.

[imariic]

Hello everyone,
I came to the project which had very old RN(0.59.9) and react-native-app-auth(4.x) versions. I upgraded both versions to the latest. After that I started having issues described here - #621 and #526. What should I do? In 4.x version everything worked perfectly, now in order to log out I have to clear cookies and browser cache manually. I've tried to add #621 (comment) but it didn't help me :(

[Jay-A-McBee]

👋 hey @imariic - Support was recently added to actually end the user's session with the OIDC provider rather than simply revoking the token. (commit). Targeting the end_session_endpoint should clear the shared cookies from the browser session used during authentication. Unfortunately, not all providers expose an end_session_endpoint. Providers are only required to expose this endpoint if they support "session management".

From the OIDC spec

2.1.  OpenID Provider Discovery Metadata
These OpenID Provider Metadata parameters MUST be included in the Server's discovery responses when Session Management and Discovery are supported:

end_session_endpoint
REQUIRED. URL at the OP to which an RP can perform a redirect to request that the End-User be logged out at the OP.

Check the discovery endpoint of your provider /.well-known/openid-configuration.
If the provider you are using exposes an end_session_endpoint, you should be able to successfully log the user out and clear out any session cookies that were shared with the browser. This would force the user to reenter their credentials the next time they authenticate through your app.

Let me know if this works out for you or if I can help troubleshoot more 🚀

[willzofsteel]

Hi @Jay-A-McBee , I am having the same issue with the cached credentials but my provider is an OAuth2 PKCE spec and not an OpenID provider and does not expose an end_session_endpoint. Is there a way to tell AppAuth to forcefully clear out the session cookies after a resolved authorize call?

[Jay-A-McBee]

@willzofsteel as far as I know there isn't. AppAuth-iOS exposes a way to provide a custom session, but even then the best we could do would be to set prefersEphemeralWebBrowserSession and cross our fingers. If the default browser on the device is Safari this would probably be effective, but on other browsers this setting still might not be honored.

I'm not sure about the equivalent on Android for Chrome custom tabs 🤷‍♂️ .

In general this sharing mechanism between an authentication session and web browsing session is desirable. It limits the number of times that a user will have to enter their credentials. If your provider doesn't expose an end_session_endpoint, your best bet is probably to clear the cookies yourself prior to making the authorize call. I haven't worked with this lib, but seems like the accepted community solution react-native-cookies.

[willzofsteel]

@Jay-A-McBee Thank you for your response. I tried using the react-native-cookies to clear the cookies but doesn't seem to work. I've tried CookieManager.clearAll() and the other specific method just to test but to no avail. The odd thing to me though is that if I go into settings for Safari and clear all Website data that clears the cookie fine.

[imariic]

@Jay-A-McBee the only solution that worked for me was implementing Linking and opening URL for logging out. However, this solution doesn't work on iOS 15 and I don't know why. I've tried to use react-native-cookies but it didn't help me.

[Jay-A-McBee]

Ah ok - I'll poke around and see if we can configure the session on iOS a little differently to avoid caching credentials. As I mentioned I think ephemeral sessions are the best we can do.

[Vorob-Astronaut]

What the solution for newbies? Would be nice if somebody could help

[Vorob-Astronaut]

@Jay-A-McBee thnx for you contribution to this repository. I really appreciate it ❤️.

I'm just stuck with this issue, so want to ask if you have any progress on this issue or can give some advice/hint how to fix it. Thanks!

[Vorob-Astronaut]

@imariic was you able to fix it?

[jadar]

I'd love to opt for ephemeral sessions. I don't care about shared cookie state, and I prefer not having it ask for permission to "Log in" when you are trying to log out.

[saurabh297]

ephemeral sessions is working for only iOS >=13 only. and for this we need to change in pod folders
anybody have solution to resolve it and where we need to add code?
what about android is there any solution for that?

[saurabh297]

ephemeralWebSession where we need to add in code.
@jadar can you please explain more.

[yannickpschroeder]

@saurabh297 Did you found a solution?

[saurabh297]

@yannickpschroeder no

[jadar]

ephemeralWebSession where we need to add in code. @jadar can you please explain more.

In the iOS library, when the ASWebAuthenticationSession is created, you need to set the prefersEphemeralWebBrowserSession property to true. See the docs here.

I did this in our native app by creating a custom subclass of OIDExternalUserAgent which is essentially a copy of the OIDExternalUserAgentIOS class but sets the property to true.

Not sure how this works (if at all) on Android.