Logout without redirect

[lorensr]

I would like to be able to call auth.logout() and not take the user away from my SPA (like auth.popup.authorize() does not navigate away from my app). Is this possible? If yes, I'm not finding the documentation

https://auth0.github.io/auth0.js/global.html#logout

Related: #474

[luisrudge]

There’s no way to do this right now. Do you want to send a pr? You can also just call the logout endpoint in an iFrame or something like that

[lorensr]

I'll do the next best thing for now, which is the returnTo option

[lorensr]

Do you keep track of feature requests anywhere?

[luisrudge]

@lorensr Hi, we keep track of feature requests via support tickets

[andreasvirkus]

Hi. I wouldn't mind PR-ing this if you'd guide me how to go about it

[andreasvirkus]

@luisrudge revisiting this feature request. Would it be possible via an http request (without the auth0.js lib) just against the logout endpoint on our auth0 domain?

[luisrudge]

I'm actually not sure if that would work. It would certainly end your Auth0 session, but I'm not sure it will clean your cookies..

[andreasvirkus]

Do you mean the cookies on the auth0 domain? So what you mean by that is when asked for a renewal, it would be possible to retrieve a renewed session?

[luisrudge]

that won't happen because the session will be removed from the server when you hit /logout. What happens after is what I don't know.. will you get an error? will the server just ignore and replace the cookie in the next login? I really don't know. It's really not something we recommend, so you'll have to try and see what happens.

[andreasvirkus]

Okay. But in theory creating an iframe with the src URL of <MY_CUSTOM_AUTH0_DOMAIN>/v2/logout is considered more safe since "the user" visits that URL when requesting its source?

[luisrudge]

This might work, yeah.

[rnwolfe]

@andreasvirkus did you get anywhere with this? I'm interested in doing the same. In my case, I'm launching from an Ionic native app (iOS/Android) which launches Safari to logout then goes back to the application.

[andreasvirkus]

@rnwolfe I don't recall how my experiments with the iframes ended up, but looking at our current code we just utilise the webAuth.logout() method with the returnTo param