Google Auth2.0 log out

Question

I'm currently trying to make a site where the user can log in with his google+ account. Most of it is working. I get them to grant access to my website. They can log in and I get their name and user ID, and I show content specific to their google account on my site.

When however someone else wants to log in and I try to 'log out' of the site, the google log in still remembers that it just logged in and after logging out it instantly runs the code to log in again. If I delete the SSID cookie from google it doesn't do this, so I'm assuming that's where google stores the fact that I just logged in with x.

Is there a way to when I log out make google not instantly log in with the same account, but rather ask for the e-mail and password of a google user?

I feel like I'm missing something obvious here, but I can't figure out how to deal with this.

Code I use to Auth and get data:

 <button class ="btn btn-primary" id="authorize-button" style="visibility: hidden">Log in</button>

<script>

  var clientId = '';

  var apiKey = '';

  var scopes = '';


  function handleClientLoad() {

    gapi.client.setApiKey(apiKey);
    window.setTimeout(checkAuth,1);
  }

  function checkAuth() {
   //alert("authorize");
    gapi.auth.authorize({client_id: clientId, scope: scopes, immediate: true}, handleAuthResult);
  }


  function handleAuthResult(authResult) {
     //alert("authorized");


     //alert(authResult.access_token);
    var authorizeButton = document.getElementById('authorize-button');
    if (authResult && !authResult.error) {
      authorizeButton.style.visibility = 'hidden';
      makeApiCall();
    } else {
      authorizeButton.style.visibility = '';
      authorizeButton.onclick = handleAuthClick;
    }
    var token = document.createElement('h4');
    token.appendChild(document.createTextNode(authResult.access_token));
    document.getElementById('content').appendChild(token);



  }

  function handleAuthClick(event) {
    gapi.auth.authorize({client_id: clientId, scope: scopes, immediate: false}, handleAuthResult);
    return false;
  }

  var x;
  function makeApiCall() {

  //return;
    gapi.client.load('plus', 'v1', function() {
      var request = gapi.client.plus.people.get({
        'userId': 'me'
      });
      request.execute(function(resp) {
        x = resp.id;
        var heading2 = document.createElement('h4');
        var heading3 = document.createElement('h4');
        heading3.appendChild(document.createTextNode(resp.displayName));
        heading2.appendChild(document.createTextNode(resp.id));

        document.getElementById('content2').appendChild(heading2);
        document.getElementById('content3').appendChild(heading3);


         $.post("token.php", {id: x});
         });

    });

  }

Gatekeeper

This is a critical question, and I find it absolutely bizarre that Google does not support this. – Canna

Is gapi.auth.signOut(); not it? I saw it on the Google page while looking for the objective c equivalent. – Discernment

Answer 1

When you make the auth call, set approvalprompt to force. This will force the consent dialog to appear every time. It overrides the default setting of "auto." You can learn more at https://developers.google.com/+/web/signin/#sign-in_button_attributes.

gapi.auth.authorize({client_id: clientId, scope: scopes, immediate: true, approvalprompt: force}

Pug

This does not address the question, nor is the approvalprompt force a solution for log out. It is only useful during certain "log in" scenarios, such as when you need to refresh the scopes that you are using or if you lost the user's refresh token and need to force the generation of a new one. – Dispart

It may not address the larger question of a sign out functionality--but it does address the explicitly-asked question of how to prompt the consent dialog. I agree that this is not a solution for sign out. – Pug

Answer 2

After the user authorizes your app, they are basically logged in to your app any time that they are also logged in to Google, especially when immediate mode is turned on.

What some sites do is have a logout link or button that displays a page or dialog that says something along the lines of "You're logged in to Google and this site with account [email protected]. If you want to switch accounts, go to google.com and log out of your Google session."

You can also track the logged in status of a user using your own cookies and setting and removing them during the appropriate events in your code. You would want to discard any tokens that your app obtained on behalf of the user during a log out event. When the user logged in again, they would not need to re-authorize your application with the popup (or redirect window), but you'd still get a new access token during the callback.

Dispart