Logout does not work consistently #7765

57 Answer(s)

• 

  0

  maliming created 2 months ago

  Support Team Fullstack Developer

  hi

  The js code will do the follow work:

  Both tabs will register a load event. If one of the tabs logs in to the website, it will write the stateKey, and then the other tab will receive the storage change event, and you can refresh or redirect to the homepage(/).

  Please ensure that the login and other pages have loaded this script

  (function () {
  
      const stateKey = 'authentication-state-id';
  
      window.addEventListener('load', function () {
          if (!abp || !abp.currentUser) {
              return;
          }
  
          if (!abp.currentUser.isAuthenticated) {
              localStorage.removeItem(stateKey);
          } else {
              localStorage.setItem(stateKey, abp.currentUser.id);
          }
  
          window.addEventListener('storage', function (event) {
  
              if (event.key !== stateKey || event.oldValue === event.newValue) {
                  return;
              }
  
              if (event.oldValue || !event.newValue) {
                  window.location.reload();
              } else {
                  location.assign('/')
              }
          });
      });
  
  }());
  

  Save Cancel
• 

  0

  alexander.nikonov created 2 months ago

  Hi. Thank you. I have the window load handler both in the OpenID server module added via AbpBundlingOptions and the same logic added via app.component.ts constructor like this (the load handler code DOES get triggered when I load Angular app pages):

      this.document.defaultView.addEventListener('storage', event => {
        if (event.key === 'access_token' && event.newValue === null) {
          this.document.defaultView.location.reload();
        }
      });
      const stateKey = 'authentication-state-id';
      const onLoad = () => {
        if (!this.currentUser.isAuthenticated) { // this.configStateService.getOne('currentUser')
          localStorage.removeItem(stateKey);
        }
        else {
          localStorage.setItem(stateKey, this.currentUser.id);
        }
        this.document.defaultView.addEventListener('storage', (event) => {
          if (event.key !== stateKey || event.oldValue === event.newValue) {
            return;
          }
          if (event.oldValue || !event.newValue) {
            this.document.defaultView.location.reload();
          }
          else {
            location.assign('/');
          }
        });
      };
      if (this.document.readyState === 'complete') {
        onLoad();
      }
      else {
        this.document.defaultView?.addEventListener('load', onLoad);
      }
      
  

  However, the error 400 is still there (with the same "The provided antiforgery token was meant for a different claims-based user than the current user." exception message): when I click "Login" button in OpenID server web page in the passive tab - neither code of authentication-state-listener.js is invoked (I put the breakpoints everywhere).

  What am I doing wrong?

  Save Cancel
• 

  0

  alexander.nikonov created one month ago

  Any update?

  Save Cancel
• 

  0

  sumeyye.kurtulus created 17 days ago

  Support Team Angular Expert

  Thank you for your patience, and I apologize for the delayed response. I have carefully revisited your concern in light of the latest updates. Based on the analysis, the logs and debugs are not triggered as the errors in question are likely occurring earlier in the process.

  Here is a detailed explanation of the issue:

  1. 400 Bad Request Error:

     This error indicates that the request to the identity provider (IdP) was unsuccessful. Common causes include:

     • Expired sessions.
     • Incorrect or missing parameters.
     • Validation issues on the IdP side.

     When this error occurs, the OpenID Connect library is unable to complete the authentication flow, leading to a secondary error.

  2. Recommended Approach:

     To achieve a clearer response from the library, consider reviewing the discussion here and implementing the solution described in this sample project.

  3. invalid_nonce_in_state Error:

     As illustrated in the attached example, this secondary error occurs when the library detects an incomplete or invalid flow and securely terminates it to prevent further processing with incorrect or missing information.

     This behavior is by design and serves as a safeguard, ensuring that broken authentication attempts are securely halted. It is not indicative of a bug, but rather a critical feature to maintain security. However, this may have downstream impacts on your business logic, so adjustments might be necessary to account for this scenario.

  

  Save Cancel
• 

  0

  alexander.nikonov created 12 days ago

  Reopening. Thank you for your response. Unfortunately, I am currently overwhelmed with my existing tasks and do not have the time to analyze your reply at the moment.

  Save Cancel

  1
• 

  0

  alexander.nikonov created 10 days ago

  @sumeyye.kurtulus thank you for the reply. Whereas I cannot handle this issue now and I did not dig into the suggested project, I have a quick question for you: will it be easy to integrate the authenticate service solution by your link into our ABP-based solution? In fact, I have no idea how it works "under the hood" now, because we just use a standard AuthService from @abp/ng.core to log out and it is place in a separate NPM component. No custom logic attached. So what is it supposed to be at the very end? Replacing AuthService of ABP with the customized version from the mentioned project via providers?

  Save Cancel
• 

  0

  masum.ulu created 3 days ago

  Support Team Angular Expert

  Hi alex,

  The problem is not exactly on client side, server is not allows you to authenticate at the same time with multiple tabs. We'll handle this behavior on client side in someway yet, this very specific case for the occur. We'll try to handle this error with specificed code or content. You might handle this problem with error handling maybe custom interceptor can help with that until we fix

  Save Cancel