search

okta / okta-signin-widget

HTML/CSS/JS widget that provides out-of-the-box authentication UX for your organization's apps
Other
376 stars 319 forks source link

Access Token Still Valid After Session Close #662

Open EarthCitizen opened 5 years ago

EarthCitizen commented 5 years ago

I'm submitting a

Background info

When closing the session, the refresh and access tokens are still valid.

Expected behavior

When closing the session, OktaSignIn should also invalidate the refresh and access tokens.

What went wrong?

As a result of the refresh and access tokens not being invalidated, the access token can still be used to call endpoints of the application, even though the OIDC Okta endpoints are being used to validate the token.

Steps to reproduce

  1. Log in with sign-in widget
  2. App calls its endpoints using access token
  3. Log out with sign-in widget (closes session)
  4. Use access token to call app endpoints with curl

Your environment

swiftone commented 5 years ago

Thanks for the feedback -

To track this down we need some clarity:

Use access token to call app endpoints with curl

Does "app" refer to your local app, or to an Okta endpoint?

Any other details you can provide will help us pin this down, thanks!

EarthCitizen commented 5 years ago

@swiftone Sorry for the ambiguity. In this case, what I wanted to express is that the front end (via JavaScript) calls the backing REST endpoints of the overall application with the access token issued by Okta. The backing REST endpoints then use Okta endpoints to validate the token.

EarthCitizen commented 5 years ago

Ideally, what would happen here is that the refresh token gets invalidated on sign-out, which I believe would invalidate the access tokens as well.

aarongranick-okta commented 4 years ago

@EarthCitizen We believe this issue has been corrected. Specifically an option revokeAccessToken was added to the signOut method in this PR: https://github.com/okta/okta-auth-js/pull/288

This change should be reflected in current version of the Signin Widget. Can you confirm with the latest version of the Signin Widget (currently 3.8.1) ? The code would be something like:

signIn.authClient.signOut({ revokeAccessToken: true })