-
Notifications
You must be signed in to change notification settings - Fork 4
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
How to perform logout of user after sign-in? #13
Comments
Here is the fundamental problem with Apple and their stupid API: I believe there is no sign-out, plus the user will not be signed out when removing the app. Even if we can properly sign out, which I want to see, the user won't be signed out when he/she uninstalls the app. Now he/she installs the app again, tries to sign-in, but there is already an Apple Sign-In user session. Thanks to brilliant Apple engineers who are incapable to think forward, Apple Sign-In will only return the user ID. You don't get the users email, you don't get the users password. You can either error and instruct the user to remove the session, but this will not work, unless the user also restarts their device. Thanks Apple. You can also try to recover the session with your backend, but this can only work, if you stored their generated user id ... in clear text, which gives your app a nice brute force attack vector, because it's only one input with a clear format, such as At least the user id is unique per development team, but yeah, Apple sucks! If there is a way to sign out the user via user ID, we could just sign the user out and force him/her to sign in with a new session, so we can always receive the email and name, like it should be in the first place. |
@martin-braun I feel your pain, developing for Apple is SUCH a nightmare in so many ways. |
Just use this if you're leveraging firebase auth: |
@jpetro416 That won't really sign you out of Apple though. |
Right but it will help you change users in your app. Also if someone is using an iphone, they can't login with another user anyways |
@jpetro416 The whole point of rightfully signing out the user from Apple is Apple's stupid session management. If you go to appleid.apple.com you can still see how the account is still signed into your app, even when the Firebase account is logged out. Once you find your user into this situation, he/she is unable to re-sign into your app, because your app won't receive any email anymore, until he/she removed the session in the apple settings (or at appleid.apple.com) and restarted his/her device. It's a huge problem that I as well had and Apple would not approve my app, because it was happening to them and even their staff wasn't able to remove their session in their own settings app in the beginning. Eventually, I had to program around that. I had to store their UserID in some way and link it to the account, securely, which is challenging, because it's essentially like storing a clear password in the database. Once the user re-signs without deleting their session prior, I will only get the UserID from Apple, but since I have stored it, I can now recover the session. I went out of my way explaining everything to them and eventually they followed my advice, started from a fresh session, so the issue would not occur anymore to them. Note that even if this plugin would provide a proper sign-out, the problem wouldn't be fixed, because what if the user just uninstalls the app after signing in and later reinstalls the app and tries to re-sign? Right, the session still will be there on Apple's end and you still will just receive the UserID. You will soon have to deal with the same mess and my piece of advice to you is to deal with it soon BEFORE sending in your app for review. |
Oh... I think it only happens in Simulator. I tried same thing on real device and it started from the new sign in step right after revocation by server! |
I have created a plugin for this problem, you should try it once and use in real device |
@Digvijaysinh2204 Bless you.
So there is a way to revoke the access token to have it send a full response on continuing logins, giving you the ability to circumvent the problem? That's clever, but it also means the session will never appear on appleid.apple.com, right? |
@martin-braun Yes, every time the apple_sign_in_plugin revokes and regenerates the token, the previous session ends, and a new one starts. This causes the user to be logged out after each session, and each login creates a new session, ensuring you always receive a full response with complete user information. |
Documentation only says about revoking credentials, but nothing about signing out users
The text was updated successfully, but these errors were encountered: