Login hint ignored. No way to force user to re-authenticate

[JonasPrapuolenis]

Login hint ignored. No way to force user to re-authenticate

Description

LoginHint is ignored if another user is already logged in. No way to workaround this issue when mobile app is re-installed.

Steps to reproduce

1. User abc@company.com installs android app and opens it.
2. User enters abc@company.com username in app. In the app there is a single username field to enter username. Entered value is then used as a login hint.
3. User presses 'next' button. This opens ChromeCustomTabs browser pointing to FusionAuth authorization endpoint. Login hint is passed into this endpoint.
4. User logs in and can fully use the app.
5. User uninstalls the app without logging out.
6. User xyz@company.com installs the android app and opens it
7. User enters his xyz@company.com username as login hint in the app and presses next.
8. This opens ChromeCustomTabs browser pointing to FusionAuth authorization endpoint. Login hint is passed into this endpoint. ChromeCustomTabs still have session of abc user, because he did not logout when uninstalling the app.
9. User abc is logged in to the app, instead of user xyz.

• There is no way to clear cookies in ChromeCustomTabs (or SafariViewController for iOS) to workaround this case.
• FusionAuth does not seem to support 'prompt=login' that could fix this and require user to re-authenticate.

Expected behavior

LoginHint should not automatically log in the wrong user into app, or there should be a way to force user to re-authenticate.

[robotdan]

In OIDC I think this would be prompt=login
https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest

[mooreds]

@JonasPrapuolenis Hmmm.

Looks like you can use a WebView instead of a ChromeCustomTab and get more control over deleting the cookies: https://stackoverflow.com/questions/50445469/how-to-clear-cookies-in-chromecustomtabs

[JonasPrapuolenis]

@robotdan is prompt=login currently supported? I tried it but did not seem to work.

@mooreds webview is not the recommended approach. See:
https://www.oauth.com/oauth2-servers/oauth-native-apps/use-system-browser/
https://support.google.com/faqs/answer/12284343?hl=en-AU
AppAuth also does not support webview for the same reasons: "WebView is explicitly not supported due to usability and security reasons."

[mooreds]

@JonasPrapuolenis fair point.

prompt=login is not currently supported.

[robotdan]

This seems to be working as designed. Closing.

Opened a feature request to support prompt=login.

• Support the prompt parameter #2208