How to properly logout from sharepoint online hosted app

Question

I have SharePoint online hosted app with multiple pages, on the first page I am getting

contextToken = TokenHelper.GetContextTokenFromRequest

and use it for own needs (clientContext = TokenHelper.GetClientContextWithContextToken), and also getting

token = TokenHelper.GetClientContextTokenWithContextToken

which I save into Session to use on other pages.

On the next pages, I get contextToken from Session and use it with

clientContext = TokenHelper.GetClientContextWithContextToken

everything works fine on all pages. I can get currentUser.LoginName / currentUser.Groups information on all pages.

But since I can open my pages in the new window and when I logged out from Sharepoint online, I still able to get currentUser.LoginName / currentUser.Groups information on pages where contextToken in the Session.

I should somehow find how to properly logout from my SharePoint hosted app when user logged out from SharePoint online.

Answer 1

There is a project on Github designed to smooth over the authentication flow, it is called azure-activedirectory-library-for-js, https://github.com/AzureAD/azure-activedirectory-library-for-js/tree/master/lib.

It does have a clear cache option that would clear the session state.

Answer 2

The Token you get from SharePoint is still valid so it is not related to if the user closed the SharePoint browser.

What you could do is to register a script on your SharePoint site that on a regular basis calls a web API hosted in your provider hosted app. Then you need to modify the TokenHelper class to destroy the Token if the web API is not called within a reasonable time.

Answer 3

As an end-user, you can sign out from SharePoint by clicking on the User icon in the welcome menu and then clicking on the "Sign out" link.

Once you are signed out, you'll see a message "You're signed out of Office 365".

Answer 4

As an end-user, you can sign out from SharePoint by clicking on the User icon in the welcome menu and then clicking on the “Sign out” link.