Skip to content

Conversation

@JohnsonEricAtSalesforce
Copy link
Contributor

🎸 Ready For Review 🥁

This corrects log out to always clear cookies from the web view to prevent them being used to sign a user in again. This prevents a case where a user who had recently logged in via MSDK 12 would still have those cookies plus the app passes false to the log out method after the app updates to MSDK 13, which would prevent the log out methods from clearing the cookies. It's an edge case, perhaps, but one we have seen in the field.

@@ -821,9 +816,6 @@
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Note this private method is only called from one location, which now has the remove all cookies statement.

*/
private fun notifyLogoutComplete(showLoginPage: Boolean, logoutReason: LogoutReason, userAccount: UserAccount?) {
// Clear cookies to ensure those used during previous log in will not be re-used to log the user in again.
CookieManager.getInstance().removeAllCookies(null)
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Now the remove all cookies call is outside of the show login page parameter's influence.

@JohnsonEricAtSalesforce JohnsonEricAtSalesforce force-pushed the bugfix/w-20173671_android-extra-session-on-logout_add-account-when-upgrading-from-mobile-sdk-12-to-13 branch from 4a936dd to 3c77365 Compare November 22, 2025 00:47
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant