authgear / authgear/authgear-server

[iOS] Login sessions survive after app deletion and re-installation

Open
#2,674 4 comments 0 reactions 0 assignees View on GitHub
cooldown/enhancement
Dominant language
Go
Stars
2k
Forks
125
Avg merge
2d 17h
Merged PRs (30d)
32

Description

## Problem

It is the default behavior of Apple Keychain which the items will not be removed after deletion of the app.
As Authgear is storing the refresh token in keychain on iOS, the login session will survive in re-installation

Sometimes this behavior is not desirable to a user.

## Appetite

??

## Solution

Thread in Apple Developer Forum suggests:
> you can effectively implement an auto delete feature by entangling the secret you store in the keychain with a key that you store on disk. If the app gets deleted that on-disk key goes away and you effectively lose access to the keychain item.

Reference: https://developer.apple.com/forums/thread/36442

Contributor guide

Open the contributing guide

Research direction

No repository files, tests, or entry points are named. Start by reviewing the Apple Developer Forum reference and the iOS Keychain handling for the refresh token; define how the on-disk key should govern access after reinstallation, then verify that deleting and reinstalling the app no longer preserves the login session.

Written by the indexing model from the issue text.

Assessment

Tech stack
ios
Domain
authentication, mobile-dev
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.