search

morehumaninternet / roar-server

GNU General Public License v3.0
0 stars 0 forks source link

Logout doesn't really log you out #39

Open shachar-langer opened 3 years ago

shachar-langer commented 3 years ago

If the user logs out and then tries to log in again, he won't be prompt to insert the username and password again. I haven't investigated it, but it's probably due to our auto-login mechanism.

will-weiss commented 3 years ago

This is due to a cookie twitter issues you, not us. Seems unlikely to be an issue, moving to backlog.

shachar-langer commented 3 years ago

This issue is indeed an issue with Twitter's cookie. When we start the authentication process, we redirect the user to Twitter's authentication process. Twitter checks if a cookie exists. If a valid cookie exists, it'll authentication the user automatically. Sadly, Twitter's API doesn't include a way to invalidate the cookie and there isn't an easy fix. After doing some research, we might be able to force the user to enter credentials after logout by calling the authorize instead of authenticate. Need to do further research about it.