I'm working on an iOS app that will be used by multiple users. For example, this will be installed at a kiosk, so multiple people will interact with it and then be able to login to Facebook and share content.
I'm able to login/logout with Facebook credentials in the application; however, when I go to login the next time... the embedded popup safari browser remembers the previous logged in user and says "You have already authorized ". What's proper way to clear the user, so that the safari browser does not remember the last user? I have searched everywhere and people suggest clearing cookies with var httpCookie:NSHTTPCookieStorage=NSHTTPCookieStorage.sharedHTTPCookieStorage()... but this returns 0 items. Any help or guidance would be much appreciated!
This should do the trick:
let storage = NSHTTPCookieStorage.sharedHTTPCookieStorage()
for cookie in storage.cookies! {
storage.deleteCookie(cookie)
}
Related
I'm planning to switch an app from the old OAuth flow with the SFSafariViewController to the new flow with iOS 11's SFAuthenticationSession. Logging in isn't an issue, the transfer to the new API took me a few minutes to implement. However logging out has me baffled.
How?
I can't find any mentioning of wanting to offer the option of logging out anywhere in the docs. Using the old SFSafariViewController to invalidate the cookies? Nope, they're not shared anymore with SFAuthenticationSession. As soon as I restart the authentication session the user get's logged in automatically and there's no way out. So how to enable logging out? Or am I simply overlooking something completely obvious?
Update:
I found a "way that works" in a technical sense, but it's bonkers for the user: Open a new SFAuthenticationSession on the logout page that clears the cookie. But that means when logging out the alert view asks the user again whether he'd like to log in via the service. If yes is selected ("logging in"), the cookie clearing logout page is opened, the user has to manually dismiss the view, which can be caught by the completion handler and we know we can open the login view again.. displaying the login prompt to log out? I really don't like this solution.
Any ideas? Am I still overlooking a completely obvious solution?
Update 2: As no one has any clue about this issue so far, this is probably not an easy one. I have filed a suggestion with Apple via their report tool to either clarify how to handle this or build it into the API if not available. Will post if I get an answer.
Update 3: After pondering the issue a bit more we found another possible (although also unattractive) solution if you can influence the login page of the OAuth provider: make cookies very short lived. Then the login page can be opened without automatic log in. However this kills the whole purpose of sharing login sessions between apps.. and you need to be able to influence the login page.
Update 4: Since iOS 12 SFAuthenticationSession is deprecated and got replaced by ASWebAuthenticationSession. However ASWebAuthenticationSession does not change anything in regard to logging out. It's still not possible. Same issue as before.
With ASWebAuthenticationSession, setting .prefersEphemeralWebBrowserSession to true prior to calling .start() will force the user to enter credentials in the browser session. While not the same as logging out, this will allow a new user to login with different credentials when launching the next session.
Update November 2020: We used #react-native-community/cookies to clear cookies as a workaround. See the snipped below as an example.
import CookieManager from '#react-native-community/cookies';
CookieManager.clearAll().catch(e => alert("Error deleting cookies during logout"))
Previous answer from April 2020. This may be helpful for anybody struggling with this. I've spent few hours testing different options, going through apps and looking how they do it and reading forums/discussions.
I haven't find a way to programatically clear cookies and there is no documentation on Apple on this.
Using FB as an example. Logging out from Safari and deleting FB app doesn't help. Any app which is downloaded will not ask for login to FB if you logged in once before through ASWebAuthenticationSession or SFAuthenticationSession.
If users ask how to force login (even though it's not your problem as a developer) you can point them to: Settings -> Safari -> Advanced -> Website Data -> Remove All Website Data (or just the ones for the provider).
If your use case needs switching of users (like in my case where we use Azure AD and users share 1 phone) you have 2 options. A) Open ASWebAuthenticationSession with the logout endpoint (as mentioned, this is very weird UX). B) Open Safari as a separate app (not inside yours) and do login/logout there. Unfortunately, there is no way to redirect the user to your app after logout if the OAuth provider doesn't support redirect on logout.
It sucks because this prevents developers from creating nice experiences on iOS for use cases where a business needs to share device between multiple users and OAuth is used as identity provider.
One of the “best” solutions I have come across is to open a logout page in system Safari (not an SFSafariViewController). Because ASWebAuthenticationSession shares cookies reliably with Safari, the expired/deleted cookie then also affects the app.
See this GitHub page for more details.
It depends on which cookie stores your login info;
If it is a session cookie, then it is not shared with Safari as per https://developer.apple.com/documentation/authenticationservices/aswebauthenticationsession
So, simply clear your local session, and the cookies will be cleared on the next app launch.
If not, and the cookie persists, then like Martin said above, you should open Safari (not SFSafariViewController) with your logout URL, then redirect back to your app.
Please let me know if you need more info. I have tested extensively with all 3 ways of authentication (ASWebAuthenticationSession, Safari, and SFSafariViewController).
For iOS 13.0 need to add SceneDelegate.swift for UISceneConfiguration
Also need to update appdelegate for UIScene implementation
Add UISceneSession Lifecycle
It is working fine this way SFAuthenticationSession issue resolved.
In one of our apps, we've already started using ASWebAuthenticationSession.
Our use case for this goes beyond just retrieving access and refresh tokens upon login. What I mean by this is, the same session cookie is used when opening the web app (whilst logged-in to the iOS app) in order to save the user from re-authenticating themselves again and again. Eventually, time comes when the user finally decides to log out of their account and may thereafter attempt to re-login again using a different account. Since the user's session cookie may still be alive by then, any re-login attempt only flashes the authentication screen momentarily, logging them in automatically back to their first account without giving them a chance to enter the credentials of the second account.
To really force the user to enter their credentials every time we present the authentication screen, we have to add to our Auth0 query params the prompt=login pair.
Here's what the URL would look like:
https://example.auth0.com/authorize?
client_id=abcd1234
&redirect_uri= https://example.com/callback
&scope=openid profile
&response_type=id_token
&prompt=login
You can find more info about this on this Auth0 doc: https://auth0.com/docs/authenticate/login/max-age-reauthentication
So here is my problem. I log in to my application, then log out of my application, but when I try to log in again, I get the screen in the link below.
Login Screen
As you can see, I don't get the opportunity to login with another user, which is what is intended.
What I tried to do was logout and then clear all the cookies in the logout using these following methods:
#IBAction func logout(sender: AnyObject) {
//Logged out here
let loginManager = FBSDKLoginManager()
loginManager.logOut()
//This is one method I tried
let appDomain = NSBundle.mainBundle().bundleIdentifier!
NSUserDefaults.standardUserDefaults().removePersistentDomainForName(appDomain)
//This is another method I tried
for key in NSUserDefaults.standardUserDefaults().dictionaryRepresentation().keys {
NSUserDefaults.standardUserDefaults().removeObjectForKey(key)
}
//And this is the last method I tried
var cookie: NSHTTPCookie
var storage: NSHTTPCookieStorage = NSHTTPCookieStorage.sharedHTTPCookieStorage()
for cookie in storage.cookies! {
var domainName: String = cookie.domain
var domainRange: Range = domainName.rangeOfString("facebook")
if domainRange.length > 0 {
storage.deleteCookie(cookie)
}
}
}
None of these seemed to solve my problem. The app is in "Development" mode in the Facebook Dev account so it might have something to do with this, but not totally sure. Does someone have any experience with this and know the solution to our problem, as shown in the image above.
The whole goal of Facebook login is to allow quick, seamless login into your Facebook account without having to re-enter credentials.
To achieve this, the Facebook SDK tries to leverage credentials that are already stored on the device, which may include:
login information from the Facebook app
cookies related to Facebook login in Safari (directly or via the SFSafariViewController)
system Facebook accounts
When you logout, you actually only have the Facebook SDK forget the credentials within the app (it clears the token). When you login again, it acts like the first time you did, and if it finds an existing user, it will use that (the Facebook SDK makes the — usually valid — assumption that there is a single person using the device, and they have a single Facebook account).
The current "favorite" path for the Facebook SDK (though that varies with SDK versions, iOS versions, and possibly other parameters) is SFSafariViewController, which shares cookies with Safari, not with your app.
If you want the user to completely log out on the device, they would then have to use the log out link within Facebook in Safari (or an SFSafariViewController).
If you want to do so programatically, you may open the following URL in Safari or an SFSafariViewController:
https://www.facebook.com/logout.php?next=[YourAppURL]&access_token=[ValidAccessToken]
You'll have to use a custom URL scheme to return to your app/exit the SFSafariViewController, though.
If you, as a user, want to see permissions request from Facebook again, you should remove the app from user's profile on Facebook.
When you are at settings screen, find your app and hit the cross button
I'm developing an internal app that will leverage our corporate Google Drive accounts and will be used on shared devices (iPads shared among teachers and students at school sites).
Is there a way to force GIDSignIn to require a password with each sign-in attempt? Right now, even after calling GIDSIgnIn.sharedInstance().signOut() (or GIDSignIn.sharedInstacne().disconnect()) the user doesn't need to enter their password the next time they access the app. That means, when the device is taken by the next user, they could very easily access the other user's account.
Am I missing something? Do I need to somehow clear the cookies store in the UIWebView that the GIDSignIn process uses?
Where available, the GIDSignIn login process uses a SFSafariViewController, not a UIWebView. It leverages the cookies (as well as passwords) stored in Safari, for a quicker login.
I don't think you would be able to clear such cookies. You should be able to force a Google log out, though, by opening https://www.google.com/accounts/Logout in an SFSafariViewController, though the interaction with the rest of your app may be a bit weird. See Logout link with return URL (OAuth) for a way to provide a return URL which you may try to use to control the process (you'll need to use an URL scheme to return, though).
Note that iOS may prompt to save login information, and then provide said login information to subsequent users. You'll need to disable that in Settings -> Safari -> AutoFill
There may be other ways of achieving it via configuration of the device, but iOS is not really designed for multiple users at the moment.
I am developing iOS App which use Facebook iOS SDK 4.
When user has already done Facebook login, by doing Facebook login the dialog which shows "user has already approved your app" had be displayed.
So, do not show the dialog. I want to know whether the user has already done Facebook login.
Anyone know the good way? I think accessToken is returned if user once had done Facebook login.
FBSDKAccessToken manage current logged user's accessToken.
According to official Facebook Login guide
"FBSDKAccessToken Represents the access token provided by a successful login. Most important, it provides a global +currentAccessToken to represent the currently logged in user."
The currentAccessToken is a convenient representation of the token of the current user and is used by other SDK components (like FBSDKLoginManager).
According to above you can check either user has valid accessToken or not and based on this you can track call login method otherwise just skip to next flow.
In Facebook the access tokens are per user so you can pass them around apps and they will work. In your case if you can ship an access token from another app you will be able to skip the next logging in and use the API normally.
However I think this this thread will help you.
Things are a little bit different with iOS cause I have done a facebook login on Android and got no such issues.
I have used latest FB SKD in my iOS app so users can use facebook account to login. Application open the FB app and comes back to my app perfectly fine. However, in some place in the app, i have to show/pull some people facebook page (safari based using WebView), but even user already used the Facebook account to login into my native ios app, but the page still ask user to login again and when they click login, it shows them the annoying FB username/pass page.
Is there anyway, that the FB safari based page can authenticate the user since it's already logged into my app using FB integration? do i have to include query or something. Please give me details how to solve this problem since i'm new in this..
thanks again for your help...
pic: https://www.dropbox.com/s/rjlptu7ufpcq3vl/fb.png
When the user switches to Facebook app to authenticate, it doesn't create a cookie for your UIWebView which is why it's asking to login again. Have the user authenticate inside the UIWebView without switching to the Facebook app.
What you're talking about also sounds like a similar thing that happens with Facebook dialogs not knowing about the current Facebook session.
If you authenticate your user via Facebook, try saying the Facebook object itself as an instance variable somewhere in memory so you can access it again (a property on a singleton controller, perhaps?).
Spawning dialogs from an authenticated Facebook object appears to let them use the dialog without reauthenticating iff you have a [FBSession activeSession]. So you'd also have to maintain an active FB session. But I'm not sure if this kind of solution will work since you didn't show specific code for how you're doing your web-based FB fetches.
This question might also prove helpful:
Implement Login with Facebook in iOS 5 and 6