Logout not working in Mobile app

[kfawcett]

For some reason, my logout is not working. The user stays logged in. Does anyone know how to logout a user on a mobile client? I’m not sure if this is due to using Redis or something else.

On the API Server, I have a Logout API Action.

On the mobile app, I have a link/button that calls the Logout Server Connect API action. On success, it is set to reset the CurrentUser Server Connect, although I’m not sure what that would actually do.

Here’s a video showing me logged in and attempting to logout, but I’m still logged in. The page would redirect me to the login page if I was successfully logged out.

Untitled: Apr 25, 2023 2:57 PM

[bpj]

I found cookies, including the auth cookie, we’re not being removed with different samesite settings than default:

Session Cookie - SameSite

There is also another issue with cookies and their options If set to SameSite None when setting a cookie, the remove step does not issue the same options and therefore does not actually remove it: [image]

[kfawcett]

Thanks @bpj! So typically the logout Server Connect removes the browser cookie, but that doesn’t work on mobile apps since they are not same site?

Looks like the logout is supposed to perform three remove actions. Not sure if this is working to remove sessions from redis.

I also stumbled across this post. Might be useful.

Clear all User Redis Sessions - NodeJS

I needed the option to log out all sessions from a user, so I coded an extension. That’s useful for something like a “Logout From All Sessions” button. It’s configured for a managed Redis database from DigitalOcean and reads the connection parameters from the .env. You can easily modify the code to use globals or options if that fits better into your stack. The input is a simple user_Id, and the extension returns the amount of deleted sessions. [CleanShot 2023-01-27 at 03.18.58] clear_sessi…

[mebeingken]

I’m not in a place to recheck this, but I know I track a “manually logged out” toggle. Not sure how/why I got to that point, but I check that to see if the user performed a logout. It may be outdated now, but I know it’s in there.