AppAuth caching issue / universal link not caught when logging out quickly

Question

On iOS 13.5 with the latest AppAuth (1.4.0), I have a weird caching / universal link issue with logging in through AppAuth, logging out and logging back in again. Based on the documentation, I first discover the configuration from the server with AppAuth:

OIDAuthorizationService.discoverConfiguration(forIssuer: URL(string: "https://identityserver.example.com/")!) { ... }

Then, I build a new request:

let signinRedirectURL = URL(string: "https://portal.example.com/signin-oidc-ios")!
let request = OIDAuthorizationRequest(configuration: config,
                                      clientId: "ios-app",
                                      scopes: ["api"],
                                      redirectURL: signinRedirectURL,
                                      responseType: OIDResponseTypeCode,
                                      additionalParameters: nil)

and present it:

appDelegate.currentAuthorizationFlow = OIDAuthState.authState(byPresenting: request, presenting: viewController) { authState, error in self.processAuthState(authState, error) }

After logging in through the in-app browser popup, the universal link is processed:

if let authorizationFlow = appDelegate.currentAuthorizationFlow, authorizationFlow.resumeExternalUserAgentFlow(with: url) {
    appDelegate.currentAuthorizationFlow = nil
} else {
    print("...")
}

Finally I process the received authState:

func processAuthState(authState: OIDAuthState, error: Error) {
    if let authState = authState, let token = authState.lastTokenResponse?.accessToken {
        appDelegate.authState = authState
        self.accessToken = token // stored later on for usage by REST API
    } else {
        print("Authorization error: \(error?.localizedDescription ?? "Unknown error")")
    }
}

When logging out, I simply throw away the authState and currentAuthorizationFlow. Then, to log in again, the same process begins again.

The weird thing now is that AppAuth does not present a login in-app-browser popup with the login mask at https://identityserver.example.com/ as before in the first login attempt after each app launch, but instead it presents that same popup with the universal link like https://portal.example.com/signin-oidc-ios?code=abcdef&scope=api&state=xyz which was previously caught by iOS and forwarded to the app leading to the call to authorizationFlow.resumeExternalUserAgentFlow(with: url) from above. Because we have not implemented the universal link fully yet, it leads to an error message, because the URL with the link is not supposed to be called in the browser in the moment but only to communicate the token to the app through the universal link mechanism.

Why does AppAuth or ASWebAuthenticationSession seemingly cache the last URL with an old token from the previous login attempt within the same app launch even though I throw away both the authState and currentAuthorizationFlow and create new ones? Is there something else I should do to "log out", clear the cookies etc?

AppAuth caching issue / universal link not caught when logging out quickly

0 Answers0