I am using ASWebAuthentication and SFAuthenticationto authenticate on a OAuth2 server with grant_type : authorization_code.

Everything work perfect except of:

  1. user login successfully
  2. Logout by revoking access token and refresh token with status code :200
  3. Tested that the revocation works <------
  4. User press login again and opens ASWebAuthentication or SFAuthentication according the iOS version and just goes directly in the app like the session is validating that the tokens are valid somehow.
  5. On iOS 13 ASWebAuthentication provides prefersEphemeralWebBrowserSession = true which solves the issue but for iOS 11/12 it looks like it is nothing I can do (except that the issue is probably on BackEnd)

When I am logging in I am passing the parameters prompt:login but still it doesn't help.

Questions

  1. Is there something that I can do to invalidate the session on ASWebAuthentication and SFAuthentication on iOS 11/12 similar to iOS 13 prefersEphemeralWebBrowserSession? (I haven't found something on the documentation. Apple doesn't allow anything)
  2. Is this an issue that can be solved on frontend (iOS) or it is a backend issue?

Thank you

Providing the code just for documentation

 print("Auth-Login : Process: Authenticate user")
    let state = String().createState(length: 4)
    let codeVerifier = String().createCodeVerifier()
    let codeChallenge = codeVerifier.pkceEncode.base64UriEncode
    let parameters = ["state=\(state)", "code_challenge=\(codeChallenge)"]
    let url = createUrl(parameters: parameters)
    guard let authURL = url else { return }
    DispatchQueue.main.async {
        self.delegate?.removeLoader()
        if #available(iOS 12.0, *) {
            print("Auth-Login : Process: Run ASWebAuthenticationSession")

            self.webAuthSession = ASWebAuthenticationSession(url: authURL, callbackURLScheme: "no.bilkollektivet.app") { (callbackUrl, error) in
                print(callbackUrl)
                if let error = error {
                    completionHandler(nil, nil, error)
                } else {
                    let result = self.getCodeFromCallbackUrl(url: callbackUrl, state: state)
                    completionHandler(result.code, codeVerifier, result.error)
                }
            }
            if #available(iOS 13.0, *) {
                self.webAuthSession.presentationContextProvider = self
                self.webAuthSession.prefersEphemeralWebBrowserSession = true
            }

            self.webAuthSession.start()
        } else {
            print("Auth-Login : Process: Run SFAuthenticationSession")

            self.sfAuthSession = SFAuthenticationSession(url: authURL, callbackURLScheme: "no.bilkollektivet.app") { (callbackUrl, error) in
                if let error = error {
                    completionHandler(nil, nil, error)
                } else {
                    let result = self.getCodeFromCallbackUrl(url: callbackUrl, state: state)
                    completionHandler(result.code, codeVerifier, result.error)
                }
            }

            self.sfAuthSession.start()
        }
    }
0

There are 0 best solutions below