Skip to content

signOut doesn't clear session #3995

Description

@hyunoosung

Environment

System:
OS: macOS 11.3.1
CPU: (16) x64 Intel(R) Core(TM) i9-9880H CPU @ 2.30GHz
Memory: 4.29 GB / 32.00 GB
Shell: 5.8 - /bin/zsh
Binaries:
Node: 17.3.0 - /usr/local/bin/node
Yarn: 1.22.17 - /usr/local/bin/yarn
npm: 8.3.0 - /usr/local/bin/npm
Watchman: 2021.06.07.00 - /usr/local/bin/watchman
Browsers:
Chrome: 98.0.4758.102
Safari: 14.1
Safari Technology Preview: 14.2
npmPackages:
next: 12.0.8 => 12.0.8
next-auth: ^4.2.1 => 4.2.1
react: 17.0.2 => 17.0.2

Reproduction URL

none

Describe the issue

Using federatedlogout code from #3938, I was able to signout from my idp and it redirects me to /signedOut page as below.

`
import React, { useEffect } from 'react'
import { signOut } from 'next-auth/react'
import { useRouter } from 'next/router'

const signedOut = () => {
const router = useRouter()

console.log('visiting signedOut')
useEffect(() => {
signOut({ redirect: false, callbackUrl: ${process.env.NEXTAUTH_URL} })
.then((data) => {
console.log('data: ', data)
router.push(data.url)
})
.catch((error: any) => {
console.debug('error: ', error)
})
}, [])

return

Signing you out...

}

export default signedOut

`

But whatever I tried, it occationally doesn't clear the session and the use is still signed in.
It sometimes clear the session but most of time it doesn't.

I've tried signOut() with or without redirect: false but the result were the same.

is there any way to clear out the session manually?

How to reproduce

Using below federatedlogout.ts code and signedOut.tsx

federated-logout.ts
`
import { getToken } from 'next-auth/jwt'
import type { NextApiRequest, NextApiResponse } from 'next'

const secret = process.env.NEXTAUTH_SECRET

export default async function federatedLogout(req: NextApiRequest, res: NextApiResponse) {
try {
const token = await getToken({ req, secret })
console.info('token: ', token)
if (!token) {
console.warn('No JWT token found when calling /federated-logout endpoint')
return res.redirect(process.env.NEXTAUTH_URL)
}

if (token.id_token) {
  const endsessionURL = `${process.env.STS_ISSUER}/connect/endsession`
  const endsessionParams = new URLSearchParams('')

  endsessionParams.set('id_token_hint', token.id_token)
  endsessionParams.set('post_logout_redirect_uri', `${process.env.NEXTAUTH_URL}/signedOut`)

  return res.redirect(`${endsessionURL}?${endsessionParams}`)
} else {
  console.warn("Without an id_token the user won't be redirected back from the IdP after logout.")
}

} catch (error) {
console.error(error)
res.redirect(process.env.NEXTAUTH_URL)
}
}

signedOut.tsx
import React, { useEffect } from 'react'
import { signOut } from 'next-auth/react'
import { useRouter } from 'next/router'

const signedOut = () => {
const router = useRouter()

console.log('visiting signedOut')
useEffect(() => {
signOut({ redirect: false, callbackUrl: ${process.env.NEXTAUTH_URL} })
.then((data) => {
console.log('data: ', data)
router.push(data.url)
})
.catch((error: any) => {
console.debug('error: ', error)
})
}, [])

return

Signing you out...

}

export default signedOut

`

session not cleared most of times.

Expected behavior

when federated-logout redirects you from idp to post_logout_uri whitch is signedOut.tsx in this case, it should sign you out and clear the session storage.

Metadata

Metadata

Assignees

No one assigned

    Labels

    triageUnseen or unconfirmed by a maintainer yet. Provide extra information in the meantime.

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions