3

I'm trying to use Google OAuth 2.0 to authenticate a webpage on my local server.

So far I've got:

  • Index.php - This page checks if user is logged into with Google account. If user is not logged in, it goes to login.php.
  • Login.php - This page redirects to Google's secure login page if no account is logged in. If only one account is logged in, it picks that and redirects back to index.php.

A logout button on index.php allows the app to logout. It logs out of the session for my webpage page only. The Google account remains logged in for other apps.

Now suppose a case where a previous user has left his account logged in. The next user logs in to the account and realizes that the website is authenticating the previous user. So, I'd want to have a logout button that would get me completely logged out of Google Accounts and then redirect back to my Login.php page.

What I've got so far is clearing the $_SESSION['access_token'] and $_SESSION['USER'], but it only logs out of the app, but not out of Google Accounts.

One approach I've tried is having a link point at https://accounts.google.com/logout in a new tab and my target webpage in the current tab. But this URL logs out of my account but still remembers my ID.

Is there a way to completely logout of Google account in a single click?

Is there a more elegant approach?

Linda Lawton - DaImTo
  • 106,405
  • 32
  • 180
  • 449
user3656562
  • 31
  • 1
  • 2
  • That's not the idea behind oauth2. Your client(app) is not supposed to do anything account related - especially not logging out the user on e.g. google. As you have realized, 'loging out' in an oauth2 scenario is done by throwing away the access token your app has been granted - and there may be other apps from other vendors also granted an access token from google. What would 'loging out from google' mean then? – Dirk Lachowski Dec 03 '14 at 17:58

1 Answers1

0

I'm facing the same problem (only using JS instead of PHP).

My one-click solution is as follows: I made a HTTP GET call from my JS code to logout URL. It logs out the user all right, but logs the error in console on the reply processing. See this post: How to logout from Google Account using AngularJS

Community
  • 1
  • 1
Herring
  • 173
  • 1
  • 10