Logout feature

[jjgonc]

Preflight Checklist

• I have completed all Troubleshooting Steps.
• I'm on the latest version of Directus.
• There's no other issue that already describes my problem.

Describe the Bug

Hey, I'm developing a login/logout feature into my frontend that is connected to directus and I'm using VUE3 and the SDK.

I posted this on discord and I they recommended me to open an issue here, so here it is xD

I have the logout button with the following code:
async logoutRequest() { await directus.auth.logout(); this.userInfo = null }

and to login I'm using :
await directus.auth.login({ email: this.email, password: this.password, }, { refresh: { auto:true, //auto-refresh the auth token once it's close to expire }, });

When I first click the logout button, the following appears into console:

then (lets suppose a user clicks again) if I click again without any user logged, the following appears:

Maybe I can be doing something wrong, but I've been recommended on discord to open the issue, so here it is 😄

To Reproduce

As described before, simply executing the logout the first time shows the refresh_token warning and at the second time (when logged out) shows the error and the warning

What version of Directus are you using?

v9.0.0-rc87

What version of Node.js are you using?

v14.17.2

What database are you using?

mySQL 8.0.25

What browser are you using?

Firefox

What operating system are you using?

Linux - Ubuntu 18.04.5 LTS

How are you deploying Directus?

terminal (npx directus start)

[rijkvanzanten]

Do you have a custom value set for the REFRESH_TOKEN_TTL environment variable in Directus?

[jjgonc]

I didn't chage that value, but it is assigned in the .env files

[rijkvanzanten]

Is the app you're calling this request from on the same domain/port as Directus? 🤔 (Cookies can be very very finicky on cross-domain and localhost)

[jjgonc]

My directus in in localhost:8055 and the frontend is localhost:8080

[rijkvanzanten]

In the network tab, when making the login request, is the cookie being returned in the response headers?

[jjgonc]

Are you talking about the "Set-Cookie"? Is affirmative, yes!
It returns an directus_refresh_token=.....

[rijkvanzanten]

What's the full cookie there? 🤔

[rijkvanzanten]

And this is throwing that warning from before??? This cookie says it expires in august, which shouldn't cause a "is rejected because it's already expired" message eh? :o

[jjgonc]

I don't know what is throwing the warn, I also don't think it is because of this

[paescuj]

is rejected because it's already expired

This is shown when a "HttpOnly" cookie is removed by the server - so this means the logout action was successful.

[paescuj]

then (lets suppose a user clicks again) if I click again without any user logged, the following appears:

You need to catch this case in your frontend app - you can't logout if there's no active session.

[rijkvanzanten]

With all the info provided, it looks like things are exactly working as expected 🙂

The logout action removes the refresh token by setting the expiry to 0, the next call to logout throws an error as the refresh token no longer exists 👍🏻

[jjgonc]

Thanks for the help, I'll tell the people out in discord so they know it is "normal"