openid / openid/AppAuth-iOS

Different Error Code For Cancelling Authentication Session During Sign Out

Open
#458 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

enhancement out-of-scope
Dominant language
Objective-C
Stars
2k
Forks
867
Avg merge
4d 48m
Merged PRs (30d)
1

Description

My issue revolves around signing out. When I launch the sign out session, there is a prompt to cancel it before the external agent window is presented. When this cancel button is tapped, the completion handler for the sign out session presents an error code OIDErrorCodeUserCanceledAuthorizationFlow -3. This is expected behavior and perfectly okay with me.

However, if the user continues and then is brought to their identity provider's page in the external agent window, there is another cancel button. When this cancel button is tapped, the completion handler for the sign out session presents the same error code
OIDErrorCodeUserCanceledAuthorizationFlow -3. This is an issue for me because the endpoint on the identity provider was already hit, and my identity provider's sign out implementation only requires that endpoint to be visited for sign out to be completed, so tapping the cancel button at this point does not necessarily cancel the session, but it dismisses the window.

For what it's worth, my app is a hybrid web application. I understand that this library is not directed towards hybrid web applications, but this is what I'm stuck with.

Describe the solution you'd like
I would expect a different error code, something like
OIDErrorCodeExternalUserAgentDismissed, so that I can respond properly.

The root of the issue is that Apple's error handling for those two cancel events results in the same error code. So somehow I need to distinguish between when the user cancelled the session - did they cancel via the popup prompt asking if they would like to leave their app? Or did they cancel during the external agent window?

I've already looked into this solution, and I have a working solution that will undoubtedly require some advice/direction. I will submit a PR for this. But in summary of the solution - I check what the top view of the app is at the moment the user taps cancel, if it is on the external agent window, then we know they cancelled it at that time.

Additional context
Here's screenshots of the two buttons I am referencing in this issue.
cancel_prompt
cancel_window

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by tracing the sign-out session's completion handler and the two cancellation paths: the pre-agent prompt and the external agent window. Review how OIDErrorCodeUserCanceledAuthorizationFlow is produced, then determine how the external-agent dismissal can be reported separately and verify both cancellation cases.

Written by the indexing model from the issue text.

Assessment

Tech stack
ios, objective-c
Domain
authentication, mobile
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.