Unable to fully logout when using refresh tokens

[tyf]

Hello @finnbai welcome to the community!

@finnbai

I’ve tried manually deleting the token in localStorage and the session cookies but nothing seems to help. Is there a tenant configuration I might be missing or a way to revoke the refresh token from the Angular SDK?

While there isn’t anything specific to the SDK, you can indeed revoke refresh tokens using the Authentication API.

@finnbai

In our tenant logs I can see the a “Success Logout” followed by a “Success Silent Auth” and then a “Success Exchange.” I think this may be due to the refresh token still being active so when the user gets to our logout page the Angular app immediately logs them back in using the refresh token.

If you’re able to inspect the /authorize call made when this occurs and see that the response_mode = query then this is indeed due to the refresh token - If response_mode=web_message then it is silent authentication via a hidden iframe.

Regardless, I definitely recommend sharing your thoughts and voting for the following feedback request if you’re up to it:

Revoke Refresh Token on Logout

Feature: Remove refresh token from Active devices on logout Description: When a user logs out of a SPA, calling the logout endpoint does not revoke the refresh token. This leaves it available for use if it is compromised on the client-side or in transit. The revoke refresh token endpoint can be called, separately, but it would be good to remove the refresh token for the device on logout. Use-case: We’re building a SaaS AI SPA and use Auth0 to protect access to our resource APIs.

Hope this helps to clarify