# Express-openid-connect isAuthenticated not working properly when logout

**URL:** <https://community.auth0.com/t/express-openid-connect-isauthenticated-not-working-properly-when-logout/130527>\
**Category:** Get Help\
**Tags:** sessions, logout\
**Created:** [March 26, 2024, 3:46pm UTC](https://community.auth0.com/t/express-openid-connect-isauthenticated-not-working-properly-when-logout/130527 "2024-03-26T15:46:44Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![rafael4](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/rafael4/32/60772_2.png) [@rafael4](https://community.auth0.com/u/rafael4)\
**Post date:** [March 26, 2024, 3:46pm UTC](https://community.auth0.com/t/express-openid-connect-isauthenticated-not-working-properly-when-logout/130527/1 "2024-03-26T15:46:44Z")

</div>

I am using express-openid-connect library to login via SSO and i’m experiencing a weird behavir

This function is called to login and check req.oidc.isAuthenticated() - if it is false, it connects into my SAML connector, which works perfectly and then later in the console.log, i can see that “authenticated: req.oidc.isAuthenticated()” logs true

```auto
router.get('/auth0sso/:org_acronym', async (req, res) => {
  const orgAcronym = req.params.org_acronym
  try {
    const auth0Connector = await ssoApp.getSSOFlow({
      ssoConnection: SSOConnection.AUTH0,
      orgAcronym,
    })

    if (!auth0Connector) {
      throw new TraytError('error').setCode(4113)
    }

    if (!req.oidc.isAuthenticated()) {
      return res.oidc.login({
        authorizationParams: {
          connection: auth0Connector,
        },
      })
    }

    if (!req.oidc?.accessToken?.access_token) {
      throw new TraytError('error').setCode(4107)
    }

    const { redirectUrl, azp } = await ssoAppv2.verifyAuth0Token({
      accessToken: req.oidc.accessToken.access_token,
      clientId: req.query.client_id,
    })
    console.log({
      authenticated: req.oidc.isAuthenticated(),
    })
    const user = req.oidc.user
    const email = user?.email

    res.redirect(`${redirectUrl}?code=${azp}&email=${email}`)
  } catch (error) {
    processError(res, error)
  }
})

```

Then, i finish my login and reach my logged webpage.  
When i try to logout, i call the following function

```auto
router.post('/logout', authenticateLogoutRequest, async (req, res) => {
  try {
    console.log({
      auth2: req.oidc.isAuthenticated(),
    })
    await usersApp.logoutUser({
      userId: req.user.userId,
      deviceId: req.user.deviceId,
      accessToken: req.accessToken,
    })
    if (req.oidc.isAuthenticated()) {
      return res.oidc.logout()
    }
  } catch (err) {
    processError(res, err)
  }
})

```

But when i log auth2, it returns false and i dont have idea why. This cause me an issue where i never is able to logout the user (as i never can see the logout log in auth0 portal in user tab, just the log in)

---

<div class="post-metadata">

**Author:** ![nik.baleca](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/nik.baleca/32/68749_2.png) [@nik.baleca](https://community.auth0.com/u/nik.baleca)\
**Post date:** [January 21, 2025, 9:32pm UTC](https://community.auth0.com/t/express-openid-connect-isauthenticated-not-working-properly-when-logout/130527/2 "2025-01-21T21:32:36Z")

</div>

Hi @rafael4

Thank you for posting your inquiry on the Auth0 Community!

I believe that your application does not delete the user cookies upon logout even after all the parameters have been set correctly according to our [OIDC logout documentation](https://auth0.com/docs/api/authentication?http&_gl=1*19s64ol*_gcl_au*MTQ0Mjc1NzMyLjE3MzM4NDI0MjM.*_ga*MTUzMjkzMjI3NS4xNzMzODM0NTky*_ga_QKMSDV5369*MTczNzQ4NjU0My43MS4xLjE3Mzc0ODg5NDcuNDEuMC4w#oidc-logout:~:text=Auth0%20Logout-,OIDC%20Logout,-SAML%20Logout).

You can attempt to delete all the user cookies as a potential workaround as follows:

```auto
/* LOGOUT ROUTER */
router.get('/logout', (req, res) => {
  req.logout();
  if (req.session) {
    req.session.destroy(function (err) {
      if (err) {
        console.log(err)
      }
      console.log("Destroyed the user session on Auth0 endpoint");
      res.redirect('https://<myapp>.auth0.com/v2/logout?client_id=<clientId>&returnTo=http://localhost:3000/');
    });
  }
});

```

Please keep in mind that the `returnTo` address is also under the **Allowed Logout URLs**.

You can read more about terminating an user’s session for OIDC in this [Knowledge Article](https://community.auth0.com/t/logout-not-working-as-cookies-persist/157306)

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\
**Post date:** [February 4, 2025, 9:33pm UTC](https://community.auth0.com/t/express-openid-connect-isauthenticated-not-working-properly-when-logout/130527/3 "2025-02-04T21:33:17Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.