authgear / authgear/authgear-server
[iOS] Login sessions survive after app deletion and re-installation
- Dominant language
- Go
- Stars
- 2k
- Forks
- 125
- Avg merge
- 2d 17h
- Merged PRs (30d)
- 32
Description
## Problem
It is the default behavior of Apple Keychain which the items will not be removed after deletion of the app.
As Authgear is storing the refresh token in keychain on iOS, the login session will survive in re-installation
Sometimes this behavior is not desirable to a user.
## Appetite
??
## Solution
Thread in Apple Developer Forum suggests:
> you can effectively implement an auto delete feature by entangling the secret you store in the keychain with a key that you store on disk. If the app gets deleted that on-disk key goes away and you effectively lose access to the keychain item.
Reference: https://developer.apple.com/forums/thread/36442
Contributor guide
Research direction
No repository files, tests, or entry points are named. Start by reviewing the Apple Developer Forum reference and the iOS Keychain handling for the refresh token; define how the on-disk key should govern access after reinstallation, then verify that deleting and reinstalling the app no longer preserves the login session.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- ios
- Domain
- authentication, mobile-dev
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 30/100