janko
commented
5 months ago I couldn't reproduce this. I created a fresh API-only Rails app, added the cookie session middleware, and created a basic Rodauth setup:
# app/misc/rodauth_main.rb
require "sequel/core"
class RodauthMain < Rodauth::Rails::Auth
configure do
enable :login_password_requirements_base, :login, :logout, :remember, :json, :active_sessions
db Sequel.sqlite(extensions: :activerecord_connection, keep_reference: false)
convert_token_id_to_integer? true
only_json? true
rails_controller { RodauthController }
account_status_column :status
account_password_hash_column :password_hash
after_login { remember_login }
extend_remember_deadline? true
end
end# app/misc/rodauth_app.rb
class RodauthApp < Rodauth::Rails::App
configure RodauthMain
route do |r|
rodauth.load_memory
r.rodauth
r.get("session") { session.to_hash.to_json }
end
endI then ran the following script that uses rack-test to make requests, and it shows the session is being cleared after logout:
require_relative "config/environment"
require "rack/test"
ApplicationRecord.transaction do
Account.create!(email: "user@example.com", password: "secret123", status: "verified")
session = Rack::Test::Session.new(Rails.application)
session.header "Host", "localhost"
session.header "Content-Type", "application/json"
session.header "Accept", "application/json"
session.post "/login", JSON.generate({ login: "user@example.com", password: "secret123" })
puts session.get("/session").body
session.post "/logout", JSON.generate({ global_logout: true })
puts session.get("/session").body
raise ActiveRecord::Rollback
end{"session_id":"8e608c2f8501cee39c83c7e2f1be3573","account_id":1,"active_session_id":"cpt19Tj6IrWZ8kM07_dawNQkopb7jO0-TVhtdfXgHH8","authenticated_by":["password"],"remember_deadline_extended_at":1707987690}
{"session_id":"17be6b30de1bb31956cbf77482810e2f"}If you still think this is a bug in rodauth-rails or Rodauth, please share a fresh Rails app that demonstrates the problem, ideally making HTTP requests in Ruby.
FelipeBodelon
I'm implementing a new authentication flow on a SPA with session cookies using rodauth-rail JSON endpoints (no JWT). So far so good (mostly, some CORS issues), except that the logout endpoint doesn't seem to be working properly.
Using email auth or google oauth it seems to be generating a session and remember token cookie correctly, but when trying to sign out via JSON API from the SPA, I get a 200 status but no response data and the session doesn't appear to be cleared. The only effect I see is that the remember cookie is removed. Here are the server logs and response info:
On the other hand, if I try to logout through Rodauth methods in generated Rails views (using the same route but with html instead of json), the session seems to end perfectly. Here are the server logs for that event:
It seems to me that the JSON request is not working in my case, maybe because of some CORS issues. Here is the request on the frontend:
Keys are auto transformed to snake_case, and as you can see, I've tried global logout. Content type and accept headers are also set to json as default.
For more info about my project configs I included them in this discussion.
Thanks in advance!