Update: This solution does not seem to work anymore in many browsers. Kaitsu’s comment: This solution of sending false credentials to make browser forget the correct authenticated credentials doesn’t work in Chrome (16) and IE (9). Works in Firefox (9). Actually you can implement a workaround by sending false credentials to the service. This works … Read more
I was having the same problem. I also login using oauth (I am using RubyOnRails), but for logout, I do it with JavaScript using a link like this: <a href=”/logout” onclick=”FB.logout();”>Logout</a> This first calls the onclick function and performs a logout on facebook, and then the normal /logout function of my site is called. Though … Read more
It’s hard for me to say for sure if your code is enough. However standard Spring-security’s implementation of logging out is different. If you took a look at SecurityContextLogoutHandler you would see they do: SecurityContextHolder.clearContext(); Moreover they optionally invalidate the HttpSession: if (invalidateHttpSession) { HttpSession session = request.getSession(false); if (session != null) { session.invalidate(); } … Read more
Brice’s answer is great, but I still noticed an important distinction to make; the Passport guide suggests using .logout() (also aliased as .logOut()) as such: app.get(‘/logout’, function(req, res){ req.logout(); res.redirect(“https://stackoverflow.com/”); //Can fire before session is destroyed? }); But as mentioned above, this is unreliable. I found it behaved as expected when implementing Brice’s suggestion like … Read more
You can and should not disable the browser back button or history. That’s bad for user experience. There are JavaScript hacks, but they are not reliable and will also not work when the client has JS disabled. Your concrete problem is that the requested page is been loaded from the browser cache instead of straight … Read more
If your login request is via a user supplying a username and password then a POST is preferable, as details will be sent in the HTTP messages body rather than the URL. Although it will still be sent plain text, unless you’re encrypting via https. The HTTP DELETE method is a request to delete something … Read more
Go to PHPMyAdmin in your browser Settings > Features > Change the value of Login cookie validity > Save NOTE: You will have to do this per session.
Introduction The ViewExpiredException will be thrown whenever the javax.faces.STATE_SAVING_METHOD is set to server (default) and the enduser sends a HTTP POST request on a view via <h:form> with <h:commandLink>, <h:commandButton> or <f:ajax>, while the associated view state isn’t available in the session anymore. The view state is identified as value of a hidden input field … Read more
In your appDelegate.m inside your didFinishLaunchingWithOptions //authenticatedUser: check from NSUserDefaults User credential if its present then set your navigation flow accordingly if (authenticatedUser) { self.window.rootViewController = [[UIStoryboard storyboardWithName:@”Main” bundle:[NSBundle mainBundle]] instantiateInitialViewController]; } else { UIViewController* rootController = [[UIStoryboard storyboardWithName:@”Main” bundle:[NSBundle mainBundle]] instantiateViewControllerWithIdentifier:@”LoginViewController”]; UINavigationController* navigation = [[UINavigationController alloc] initWithRootViewController:rootController]; self.window.rootViewController = navigation; } In SignUpViewController.m file … Read more