We have a tricky problem with expired or deleted s...
# ory-networka
ancient-judge-84558
05/16/2023, 9:05 AMWe have a tricky problem with expired or deleted sessions.
Let’s say a user is logged in and gets a session cookie. When the session expires on the server, the session cookie is still in the browser. Every call to our backend now gives a 401. And since the Cookie is httpOnly, we can’t delete it on the client side. An Ory logout flow is rejected with 401 by Ory as well. What is the correct way to handle this situation?
ancient-judge-84558
05/16/2023, 3:22 PMNo responses to this?
This is breaking our app for our users, since nothing works once this happens.
Is there no way to somehow get rid of the session cookie on the client side, so that the user is simply unauthorized again?
ancient-judge-84558
05/16/2023, 4:26 PMI suppose the httpOnly session cookie is controlled by oauthkeeper? Or where else is it controlled?
Is there a mechanism to tell oathkeeper to throw away the cookie, when it’s producing a 401 error?
f
fast-lunch-54279
05/16/2023, 8:40 PM
how do these sessions expire? logout should delete the cookie.
a
ancient-judge-84558
05/17/2023, 7:38 AMThey expire because they time out. Or because they are explicitly deleted on the server. And we also get into that situation sometimes when deleting a user that is still logged in.
ancient-judge-84558
05/17/2023, 8:03 AMThe problem is we do not log out and once the session is invalid, we can no longer log out.
4 Views