0

NOTE: I am not interested in calling /secur/logout.jsp since it ends all the active salesforce sessions.

I am developing a web application that is registered on salesforce as a connected app, so I am using salesforce credentials to authorize the user.

Application is developed in REST API and the communication with salesforce is happening in restful manner.

Auth url: https://login.salesforce.com/services/oauth2/authorize

Authorization:

Method 1: If there is no salesforce session active, The user is taken to salesforce login page, where he enters his salesforce details to be authorized and after which he is taken to home page of my web application.

Method 2: If there is already a salesforce session active in another tab, the user is directly authorized and is taken to home page of my web application.

Now I am trying to implement logout button for my application, such that the following scenarios are covered,

Scene 1: The user is authorized using method1, and the user press the logout. Upon trying to logback the user is prompted for credentials.

Scene 2: The user is authorized using method2, and the user should use logout to logout of the web application (not from active sessions). Upon login, the user should be again able to login using method2.

Can someone help me on how to implement the logout button such that it covers scenario 1 & 2.

Thanks in advance.

Improve this question
1

You need to "revoke" the token that was granted to your connected app by sending a POST to the following URL:

https://login.salesforce.com/services/oauth2/revoke

Example:

POST /revoke HTTP/1.1
Host: https://login.salesforce.com/services/oauth2/revoke 
Content-Type: application/x-www-form-urlencoded

token=currenttoken

The user will remain logged into Salesforce, but the token that was granted to your app will become inactive.

Source: https://help.salesforce.com/apex/HTViewHelpDoc?id=remoteaccess_revoke_token.htm

Improve this answer
  • Hi, I tried that but that is only revoking the access token. Next time I try to login, the user is automatically logged in without asking for credentials though there are no other active sessions. – Rakesh D Jul 19 '16 at 8:05
  • Once a connected app has been authorized by a user, thry are not prompted to grant access again. This might be a design consideration of your app. What happens when a user accesses it and they are not authenticated? In my experience it is better to give them a "login" button that redirects them to Salesforce as opposed to automatically redirecting them. – dana Jul 19 '16 at 14:12
  • When the user clicks "logout" you should 1) destroy their auth session on your server, 2) revoke the Salesforce access token, 3) display a message "You've been logged out". If they try to login again and still have an active Salesforce session, then a new access token will be granted. – dana Jul 19 '16 at 14:18
  • I have a login button that redirects them to salesforce login page. but once an user is logged in and press logout, I revoke their access, refresh tokens and invalidate the existing session and redirect them to login screen. Now when the user tries to login, he is not asked for credentials. The previous credentials are used and the user is logged in to the application. How do I prevent this from happening? How do I destroy the authentication session? – Rakesh D Jul 21 '16 at 21:28
  • 2
    What about setting prompt=login query string parameter? For example: login.salesforce.com/services/oauth2/… - Per the documentation this should force the user to login again. source: developer.salesforce.com/page/… – dana Jul 21 '16 at 23:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.