auth0 / auth0-react

Auth0 SDK for React Single Page Applications (SPA)
MIT License
891 stars 259 forks source link

Automatic logout when active user is blocked disappeared after update to v2 #814

Open pldvd opened 1 day ago

pldvd commented 1 day ago

Checklist

Description

After updating to auth0-react v2, we noticed that our active users don't get logged out, after they are blocked in the Auth0 Dashboard / User Management and their current token expires.

V1 behavior: when their current token expired, blocked users were immediately logged out from the platform when trying to acquire a new token. V2 behavior: blocked users can still interact with the app after their current token expired. getAccessTokenSilently() returns a 'user is blocked' error, the network log is filled with

We have been using a custom cache implementation, which seems to interfere with this behavior:

  import { set, get, del, keys } from "idb-keyval";

  const cache = {
    get: (key) => get(key).then((cacheable) => cacheable || null),
    set: (key, cacheable) => set(key, cacheable),
    remove: (key) => del(key),
    allKeys: keys,
  };
  return cache;
};

Using the sample application the following were validated using v2:

Using the sample application the following were validated after downgrading to v1:

Reproduction

On v2: Step1: Run sample app with custom cache implementation Step2: Block the current user in Auth0 Dashboard and wait for the token to expire Step3: Try to fire the external API call and observe how you are not logged out immediately.

On v1 this logout happened automatically on the first interaction with the App (after the blocked user has expired), you can verify it by downgrading to v1 in the sample app and going through the above steps.

Additional context

We solved the issue for now by calling logout() manually after checking the error in the catch block of getAccessTokenSIlently(), if (error.message === 'user is blocked') logout() but this looks like a hack compared to the previous behavior.

auth0-react version

2.2.0

React version

17 (our app) & 18 (sample app)

Which browsers have you tested in?

Chrome

pldvd commented 23 hours ago

Hey! So just to clarify, it definitely has to do with the custom cache implementation which, until we were on v1, worked fine. Now on v2 we need to manually logout the user when the token endpoint returns a "user is blocked" error.