search

mozilla / django-browserid

Django application for adding BrowserID support.
Mozilla Public License 2.0
180 stars 80 forks source link

Logout not working #217

Closed seocam closed 10 years ago

seocam commented 10 years ago

If a user clicks in the logout button when the website is actually down (during a restart for example) the user can't login after the service is back again.

I'm using 3d3c86cbfb277002af814ea8e34adf639cd70c32

Osmose commented 10 years ago

If you right click the logout link, copy the URL, paste it into the location bar and visit it, does logout work successfully again?

If so, I believe I know the cause. When you click the logout button, we first call navigator.id.logout to log you out of Persona, and then once that finishes, we redirect the user to the logout view so they can log out of your site. We don't handle the case where logout doesn't call the callback, which happens if Persona thinks you're already logged out.

There's a few approaches to fixing this on our end:

  1. Don't logout from Persona until after logging out of your own site. Annoying because you have to avoid the fact that Persona will try to log you back in on the next page load.
  2. Have some reasonable timeout after which, if the logout callback hasn't been run, you run it automatically.
  3. Opt out of Persona-based session management, meaning you don't have to call logout at all. This can be done manually, by making your auto-login and auto-logout callbacks not trigger login and logout, or by using the newer session-less API, which is blocked from landing in production due to mozilla/persona#4027.

(3) using the new API is the preferred long-term solution, but if that train takes much longer to land I'm going to consider just fixing these issues while we wait for it to land.

seocam commented 10 years ago
  1. If I access /logout I get redirected to LOGOUT_REDIRECT_URL but still authenticated.
  2. If I accesst /browserid/logout/ I get a JSON response: {"error": "Method not allowed."}

So far the only way I found to logout was to erase my session cookie.

Osmose commented 10 years ago

Taking this bug. Given Persona's current state of development (no paid employees, contributor-only while work on Firefox Accounts happens) we can't expect the new API to land any time soon, so I'm going to just make auto-login/auto-logout not happen with django-browserid anymore.

seocam commented 10 years ago

Makes sense. @Osmose let me know if I can help you somehow.