Subject: [OAUTH-WG] need advice on sign out after performing sign in via OAuth 10x

From: Adrian Servenschi <[email-masked]>
Date: Wed, 2 Jan 2013 23:25:57 +0200

Hi guys,

I am working on implementing login/registration with common identity
providers into our application.
I am using Scribe for java library which implements the *OAuth* protocol.

I've encountered what I consider a small security issue that I don't know
how to solve.
If I sign in into our application via let's say Google and then I sign out,
the Google session cookie remains active in the browser.
I can open Gmail afterwards in my browser and my inbox is displayed without
the need of authentication.

Imagine that a user signs in to our application in an internet cafe, then
signs out and leaves the facility.
A different client comes at the same desk, opens Gmail and he/she sees the
inbox of the first person.
This can be a security hazard which I don't know how to solve.
I see only 3 options:

1) I can leave it like this --> hazardous
2) If I use Google API to sign out the user from the Google when performing
Sign out from our application then the user will be signed out from every
Google application he has opened in his browser.
In addition I heard that the documentation for performing Sign Out via
various identity providers APIs is not quite clear. But this still needs to
be investigated.

3) The third option : displaying some informative text when the user sings
out from the application informing him that he/she signed out from our
application only, and not from Google/other identity provider,
seems to be the best option.

I will highly appreciate if you can advise me regarding this issue.
Thank you very much in advance!

Adrian Servenschi.

P.S. This is what I found on Facebook Platform Policies page
http://developers.facebook.com/policy/ <http://developers.facebook.com/policy/>
Your website must offer an explicit "Log Out" option that also logs the
user out of Facebook.

So indeed a form of 3) option will be the best choice?
Looking forward to your advices and suggestions.

---

From: Justin Richer <[email-masked]>
Date: Thu, 3 Jan 2013 12:03:39 -0500

Hi Adrian,

This isn't really an OAuth question, especially since OAuth is not an 
authentication protocol on its own. It is used by several authentication 
protocols, such as OpenID Connect, Google, and Facebook -- which is 
where your questions really lie. Thus, OAuth itself can't help you with 
the sign out issue here and any answers are going to be more server 
specific.

I would encourage you to re-post this question onto Stack Overflow with 
the appropriate tags, such as "oauth", "facebook", "google", etc.

  -- Justin

On 01/02/2013 04:25 PM, Adrian Servenschi wrote:
> I've encountered what I consider a small security issue that I don't 
> know how to solve.
> If I sign in into our application via let's say Google and then I sign 
> out, the Google session cookie remains active in the browser.
> I can open Gmail afterwards in my browser and my inbox is displayed 
> without the need of authentication.
>
> Imagine that a user signs in to our application in an internet cafe, 
> then signs out and leaves the facility.
> A different client comes at the same desk, opens Gmail and he/she sees 
> the inbox of the first person.
> 2) If I use Google API to sign out the user from the Google when 
> performing Sign out from our application then the user will be signed 
> out from every Google application he has opened in his browser.
> various identity providers APIs is not quite clear. But this still 
> needs to be investigated.
>
> 3) The third option : displaying some informative text when the user 
> sings out from the application informing him that he/she signed out 
> from our application only, and not from Google/other identity provider,
> Your website must offer an explicit "Log Out" option that also logs 
> the user out of Facebook.
>
> _______________________________________________
> OAuth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/oauth

---

From: William Mills <[email-masked]>
Date: Thu, 3 Jan 2013 09:54:17 -0800 (PST)

Don't use OAuth, use OpenID.  OAuth isn't designed for authentication and OpenID is.

________________________________
 From: Adrian Servenschi <[email-masked]>
To: [email-masked] 
Sent: Wednesday, January 2, 2013 1:25 PM
Subject: [OAUTH-WG] need advice on sign out after performing sign in via OAuth 10x

Hi guys,

I am working on implementing login/registration with common identity providers into our application.
I am using Scribe for java library which implements the OAuth protocol.

I've encountered what I consider a small security issue that I don't know how to solve.
If I sign in into our application via let's say Google and then I sign out, the Google session cookie remains active in the browser.
I can open Gmail afterwards in my browser and my inbox is displayed without the need of authentication.

Imagine that a user signs in to our application in an internet cafe, then signs out and leaves the facility.
A different client comes at the same desk, opens Gmail and he/she sees the inbox of the first person.
This can be a security hazard which I don't know how to solve. 
I see only 3 options:

1) I can leave it like this --> hazardous
2) If I use Google API to sign out the user from the Google when performing Sign out from our application then the user will be signed out from every Google application he has opened in his browser.
In addition I heard that the documentation for performing Sign Out via various identity providers APIs is not quite clear. But this still needs to be investigated.

3) The third option : displaying some informative text when the user sings out from the application informing him that he/she signed out from our application only, and not from Google/other identity provider,
seems to be the best option.

Adrian Servenschi.    

P.S. This is what I found on Facebook Platform Policies page http://developers.facebook.com/policy/
Your website must offer an explicit "Log Out" option that also logs the user out of Facebook.
So indeed a form of 3) option will be the best choice?
Looking forward to your advices and suggestions. 
_______________________________________________
OAuth mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/oauth

---

From: John Bradley <[email-masked]>
Date: Thu, 3 Jan 2013 15:01:43 -0300

It sounds like your issue is logging the user out of the IdP.   There are several non interoperable ways of doing that in SAML.

That is out of scope for OAuth itself.

In the open internet the issue tends to be that IdP  don't want to be accepting logout messages from RP that terminate the users session without confirmation of the user.  

In openID Connect we are doing some things with session management where a RP can redirect a user to the IdP to terminate sessions, however that is optional for the IdP to implement.

For the moment you will have to deal with each IdP separately if you want to try and kill idP sessions when the user logged out of your RP.

John B.

On 2013-01-02, at 6:25 PM, Adrian Servenschi <[email-masked]> wrote:

> Looking forward to your advices and suggestions. _______________________________________________
> OAuth mailing list
> [email-masked]

---

From: George Fletcher <[email-masked]>
Date: Thu, 03 Jan 2013 15:42:51 -0500

There is no standardization of the logout flow in OAuth or OpenID (there 
is in OpenID Connect as John mentioned) so your option 3...

is the best option right now.

The problem is that as the application you don't know if the user signed 
in with Google just to access your app, or if they already had gmail 
open. In the first case it would be nice to sign the user out of Google 
since they authenticated solely for the purpose of accessing your app. 
In the second case you DON'T want to sign them out as that will kill 
their gmail session which is probably not what the user (or your app) wants.

So, informing the user that they are still logged in at Google is a good 
choice. You might want to give the user the option to forgo the warning 
in the future once they understand what is happening.

Thanks,
George

---

From: Adrian Servenschi <[email-masked]>
Date: Tue, 8 Jan 2013 02:24:54 +0200

Thank you George, John, William and Justin,

Your responses are knowledgeable and extremely helpful.

You are a great team.
Thanks again.
Adrian Servenschi.

On Thu, Jan 3, 2013 at 10:42 PM, George Fletcher <[email-masked]> wrote:

> in with Google just to access your app, or if they already had gmail open.
> In the first case it would be nice to sign the user out of Google since
> they authenticated solely for the purpose of accessing your app. In the
> second case you DON'T want to sign them out as that will kill their gmail
> session which is probably not what the user (or your app) wants.
>
> choice. You might want to give the user the option to forgo the warning in
> the future once they understand what is happening.
>
> Thanks,
> George
>
>
> performing Sign out from our application then the user will be signed out
> from every Google application he has opened in his browser.
> sings out from the application informing him that he/she signed out from
> our application only, and not from Google/other identity provider,
> OAuth mailing [email-masked]://www.ietf.org/mailman/listinfo/oauth
>
>
>