Login Session Still Persists Despite Logout

[Ankush263]

p5.js version

1.7.0

What is your operating system?

Windows

Web browser and version

chrome, edge, Brave

Actual Behavior

When we try to log out, the session Id is not deleted

As a result, after clicking logout, when I refresh the page, I again enter the login state on the website.

Expected Behavior

The sessionId got deleted and after refresh, the user can not go back to the login state.

Steps to reproduce

Steps:

1. click logout.
2. hit refresh
3. you get back to login state

[welcome]

Welcome! 👋 Thanks for opening your first issue here! And to ensure the community is able to respond to your issue, be sure to follow the issue template if you haven't already.

[Ankush263]

I think this is happening because this line of code inside /server/controllers/session.controller.js

Here, req.logout does not delete the session Id, so it still remains the same
I'm gonna raise a PR to resolve this issue

[pankajdharmik4]

Are you working on this issue?

[lindapaiste]

This is probably a duplicate of #2292

Right now on production if I hit "log out" I get a 500 Internal Server error from the API. That error was fixed by #2299 but I don't think we've pushed to production since.

Regarding the session id, I honestly don't understand cookies that well so I'm not sure if a change is needed there or if the previous fix is enough. We are using passport to manage the login and I suspect that when the API works properly calling req.logout will destroy the session id.

[Ankush263]

But in this case req.logout does not delete the session id, that's why when you hit refresh, you again got into login state

[lindapaiste]

But in this case req.logout does not delete the session id, that's why when you hit refresh, you again got into login state

Are you able to see this happening (session id not deleted) on localhost? If it's only happening on production then I really think it's due to the req.logout function not firing at all, due to the bug. You have found that bug but I think that what you are seeing with the session id is a symptom rather than a cause.

Again I am not on expert in this area but here is what the passport docs say:

Passport exposes a logout() function on req (also aliased as logOut()) that can be called from any route handler which needs to terminate a login session. Invoking logout() will remove the req.user property and clear the login session (if any).

[Ankush263]

Ok, I understand👍

[rajatmohan22]

@lindapaiste I might have found a way to resolve this issue. Do check: #2473

[dhowe]

Also have this serious bug on firefox/chrome for mac.

Occurs not only on refresh, but also opening a new tab/window:

1. logout of account
2. close tab
3. open new tab
4. still logged in