Providing app credentials to access a private resource retains those credentials even after logging out

Esri / data-collection-ios

Mobile data collection app using the iOS Runtime SDK.

https://developers.arcgis.com/

Apache License 2.0

25 stars 26 forks source link

Providing app credentials to access a private resource retains those credentials even after logging out #141

Closed mikewilburn closed 5 years ago

mikewilburn commented 5 years ago

Steps to repro:

Launch the app with web map item id 1300bf23f97f4a2bb6ede795dfab8b72 (this is a private web map that contains private layers)

Notice that when the map loads, you're prompted to log in
Log in with your credentials

Notice that the map loads, complete with a feature layer this time You're able to interact with the map, identify features, view their attributes, and even edit them
Go to the hamburger menu and log out

The map remains loaded and all features still exist in the map view & are identifiable

Expected behavior: logging out should remove access to the private resource

esreli commented 5 years ago

@mikewilburn this change has been merged into master. Can you confirm it's been fixed?

mikewilburn commented 5 years ago

Verified that this is working as it should. After logging out of the app, the authentication page re-appears prompting the user to provide their credentials. Clicking CANCEL or Done on this page returns to the app, but the next action to interact with the map (pan, zoom, or click to identify a feature) will re-prompt the authentication page. Marking this closed.

esreli commented 5 years ago

I've determined this issue is due to a bug. Will be opening a PR to fix this bug.

esreli commented 5 years ago

@mikewilburn this bugfix has been merged into master. Can you confirm it works as expected?

mikewilburn commented 5 years ago

In some ways, this works even better than before. For instance, the act of logging out immediately prompts the Log in dialog. Clicking Cancel returns to the map view but with the message "Could not load map. " clearly displayed. Clicking Reload Map re-prompts the authentication challenge or Log in dialog to appear again. Verified that this bug fix is working as expected.