Logout sometimes does not clear Auth0 session

Help
,
1

We are using Auth0 with Angular-based SPA. The problem we are facing is that logout is working in 95% of the cases, while in remaining 5% of cases Auth0 session is not cleared after navigating to /v2/logout.

“Good” workflow (happens in 95% of cases):

  1. User clicks “logout” button
  2. Code: logout handler clears local session
  3. Code: logout handler calls this.auth0Service.logout({returnTo}) (where auth0Service is an instance of AuthService from @auth0/auth0-angular npm package).
  4. User follows redirect to /v2/logout → returnTo
  5. User clicks “login”, and follows redirects /authorize → /login and is challenged for credentials

“Bad” workflow (happens in 95% of cases):

  1. User clicks “logout” button
  2. Code: logout handler clears local session
  3. Code: logout handler calls this.auth0Service.logout({returnTo})
  4. User follows redirect to /v2/logout → returnTo
  5. User clicks “login”, and follows redirects /authorize, but then authorize endpoint finds an existing Auth0 session, and therefore skips redirect to /login, and redirects the user straight to returnUrl with authorization code

Notes:
The only difference that we were able to pinpoint between “good” and “bad” flows is that in “bad” case /v2/logout endpoint besides sending a 302 redirect sets a cookie __cf_bm. While in “good” case no cookie is set by logout endpoint.

Some service headers from one example “bad” /v2/logout request:

  • x-auth0-requestid: 19c4ce702956f26d98a2
  • ot-baggage-auth0-request-id: 757e104d8c3b7549
  • ot-tracer-sampled: true
  • ot-tracer-spanid: 5a9def305893c4ba
  • ot-tracer-traceid: 6da89b985f9dbef5
  • traceparent: 00-5a9def305893c4ba-00000000000000006da89b985f9dbef5-01
  • tracestate: auth0-request-id=757e104d8c3b7549,auth0=true