Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Invalid access token in Authentication webview #3738

Open
sortinousn opened this issue Jul 7, 2024 · 1 comment
Open

Invalid access token in Authentication webview #3738

sortinousn opened this issue Jul 7, 2024 · 1 comment

Comments

@sortinousn
Copy link

Please fill out the following details:

  1. Version of Mobile SDK Used: 12.0.1
  2. Issue found in Native App or Hybrid App: Native
  3. OS Version: All
  4. Device: IPhone 13 Pro
  5. Steps to reproduce:

We are using the embedded login in salesforce to log the user in. We have a passive logout function on our member portal that logs the user out after 15 minutes of inactivity where the session is ended and access token is invalidated. We call this single logout function in the connected app (https://xxxxxxx.my.salesforce.com/services/auth/idp/oidc/logout) to log the user out. This works fine on the desktop browser, however on the mobile app when the user goes to log back in after the passive logout they get a blank screen after authentication. This issue is happening in the Authentication webview I believe its caused by a cached session or token. The only fix seems to be to have the user uninstall the App and reinstall the app, however this problem will continuously pop up if they are passively logged out and try to log back in again. As I said it works fine the desktop browser, but in the app authentication webview there must be some disconnect or an invalid session thats being called, its hard to troubleshoot since we aren't really getting an error.

Is there a way to clear the authentication helper webview cache or get a new session?

In our ContentView.swift webview (after authentication) when passive logout happens server side we call this function in our webview to direct the user back to login.

         .... webview ....
            if url.description.lowercased().contains("logout") {
                // Passive logout has been called, navigate app back to the authentication webview.
                // swiftlint:disable force_cast
                let delegate = UIApplication.shared.delegate as! AppDelegate
                AuthHelper.loginIfRequired {
                    delegate.setupRootViewController()
                }
                decisionHandler(.cancel)
                return
            }

I have also tried calling these methods on logout as well in our webview but I still have the same issue

//                UserAccountManager.shared.logout()
//                UserAccountManager.shared.logoutAllUsers()
//                UserAccountManager.shared.currentUserAccount?.credentials.revoke() 
  1. Actual behavior: User Logs in to app successfully, gets passively logged out due to 15 minutes of inactivity. Users gets prompted for biomrics/username password but is directed to a blank screen after authentication.

  2. Expected Behavior: User Logs in to app successfully, gets passively logged out due to 15 minutes of inactivity. Users should be able to log back in to the authenticated experience with biometrics or username and password.

  3. Error Log:

@sortinousn sortinousn changed the title Invalid cookie/token in Authentication webview Invalid access token in Authentication webview Jul 9, 2024
@sortinousn
Copy link
Author

I think this issue may be related to #3619. I can confirm via the introspection API that the access token being used is infact invalid. Logging back in via the built in SDK functions in the scenedelegate does not retrieve a new token. I was actually able to reproduce the issue by revoking the token after login and then calling loginifrequired.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant