next-auth: Signout does not logout user when session is being requested simultaneously

Up with this.

This seems to only happen on our prod when multiple requests are firing at once. The signOut doesn’t work as intended and only refreshes the page(without logging out the user)

Solution:

1. hit GET /logout endpoint of the provider to destroy user’s session
2. do signOut() to clear session cookies, only if step 1 was successful

for more details: https://stackoverflow.com/a/75484849/12581494

I had a similar issue with this while using the Keycloak provider. Next auth was clearing the session on the browser side, but not on the Keycloak server itself. The fix I implemented was to await the signOut function of next auth and use a callbackUrl to a signout page I created that calls the end session endpoint of Keycloak and redirects back to the website itself.

await signOut({ callbackUrl: "/api/auth/logout", });

And then pages/api/auth/logout.ts export default (req, res) => { const url = process.env.REDIRECT_URL; res.redirect(url); }

Hi @ben-walcutt ,

Not related to the issue but there is a better approach on your problem by adding it on next-auth’s event(https://next-auth.js.org/configuration/events#signout)

// [...next-auth].ts
events: {
    async signOut() {
      // add here
    },
  },

It’ll be called after triggering signOut

events: { async signOut() { // add here }, },

can i ask add what here?

This issue still occurs, happens to me if there are more than 3 tabs open simultaneously. The user will logout and right be logged in again, the session status going from loading to unauthenticated to authenticated.

Not sure why but on production after the provider logs out the user from their service and redirects back to our web app - the session will not clear even if signOut from NextAuth is called on the client side.

NextAuth + Azure AD Provider

         <a
            href={`https://login.microsoftonline.com/${process.env.NEXT_PUBLIC_AZURE_AD_TENANT_ID}/oauth2/v2.0/logout?post_logout_redirect_uri=${process.env.NEXT_PUBLIC_NEXTAUTH_URL}/auth/signout`}
          >
            Log out
          </a>

// pages/auth/signout.js
import { signOut } from "next-auth/react";
import { useEffect } from "react";
import { useSession } from "next-auth/react";
import { useRouter } from "next/router";
export default function index() {
  const router = useRouter();
  const { data: session, status } = useSession();

  useEffect(() => {
    if (status === "authenticated") {
      signOut({ redirect: false });
    } else if (status === "unauthenticated") {
      router.push("/");
    }
  }, [ status]);

  return <div></div>;
}

update: When there are multiple tabs open with the same user login the logout function don’t work, it only works when single tab is opened. I think this is a major issue Auth.js/Next-Auth should check it.

that’s not true. check out: https://github.com/nextauthjs/next-auth/blob/main/packages/next-auth/src/react.tsx#L311 when you signOut other tabs are communicated of signOut

It is true.

Exact same thing that @sulaimanwebdev commented out is happening to me as well.

update: When there are multiple tabs open with the same user login the logout function don’t work, it only works when single tab is opened. I think this is a major issue Auth.js/Next-Auth should check it.

I’ve resolve this issue with the following solution:

export function SignOut() {
  const router = useRouter();
  useEffect(() => {
    async function main() {
      await signOut({ redirect: false });
      router.push("/signin");
    }
    const timeout = setTimeout(() => main(), 500);
    return () => clearTimeout(timeout);
  }, [router]);
  return <LighthouseLoading />;
}

Same issue with FusionAuth here… Any ideas?

I am still having this issue, signOut does not delete the session. How can I delete the session by myself?