Federated SignOut immediately signs back in and fails

[dibell]

Describe the bug
Federated auth calls cognito /logout successfully but then the app immediately calls /login which then fails with the error:
Required String parameter 'redirect_uri' is not present

To Reproduce
I'm just using the 'Full React Sample' code from https://aws-amplify.github.io/docs/js/authentication
with the following oauth config (which matches the Callback URLs and Sign out URLs config on the User Pool.

Clicking the 'Sign in' button works. Then clicking 'Sign out' does sign out but results in the Required String parameter 'redirect_uri' is not present error from cognito.

const oauth = {
  domain: '<mydomain>.auth.eu-west-2.amazoncognito.com',
  scope: ['phone', 'email', 'profile', 'openid', 'aws.cognito.signin.user.admin'],
  redirectSignIn: 'http://localhost:3000',
  redirectSignOut: 'http://localhost:3000',
  responseType: 'code'
};

Expected behavior
I would expect the app to remain in a logged out state and not to retry a login immediately.

Screenshots
This shows the network tab and the call out to /logout followed by /login

These are the redacted URLs
https://domain.auth.eu-west-2.amazoncognito.com/logout?client_id=clientid&logout_uri=http%3A%2F%2Flocalhost%3A3000
https://domain.auth.eu-west-2.amazoncognito.com/login?client_id=clientid&logout_uri=http%3A%2F%2Flocalhost%3A3000
https://domain.auth.eu-west-2.amazoncognito.com/error?client_id=clientid&logout_uri=http%3A%2F%2Flocalhost%3A3000

Logs
Ampliify DEBUG logs of the session as follows:

[INFO] 57:50.63 Cache - Remove item: key is federatedInfo
ConsoleLogger.ts:99 [DEBUG] 57:50.66 AuthClass - user sign out CognitoUser {username: "...", pool: CognitoUserPool, Session: null, client: Client, signInUserSession: null, …}
ConsoleLogger.ts:99 [DEBUG] 57:50.67 Hub - Dispatching to auth with  {event: "oAuthSignOut", data: {…}, message: "Signing out from https://<domain>.auth.eu-we…d40k9l72&logout_uri=http%3A%2F%2Flocalhost%3A3000"}
ConsoleLogger.ts:99 [DEBUG] 57:50.67 Hub - Dispatching to auth with  {event: "oAuthSignOut", data: {…}, message: "Signing out from https://<domain>.auth.eu-we…d40k9l72&logout_uri=http%3A%2F%2Flocalhost%3A3000"}
ConsoleLogger.ts:99 [DEBUG] 57:50.68 Analytics - on hub capsule auth {event: "oAuthSignOut", data: {…}, message: "Signing out from https://<domain>.auth.eu-we…d40k9l72&logout_uri=http%3A%2F%2Flocalhost%3A3000"}
ConsoleLogger.ts:99 [DEBUG] 57:50.68 Hub - Dispatching to auth with  {event: "oAuthSignOut", data: {…}, message: "Signing out from https://<domain>.auth.eu-we…d40k9l72&logout_uri=http%3A%2F%2Flocalhost%3A3000"}
App.js:36 Hub oAuthSignOut
ConsoleLogger.ts:91 [DEBUG] 57:50.68 OAuth - Signing out from https://<domain>.auth.eu-west-2.amazoncognito.com/logout?client_id=<clientid>&logout_uri=http%3A%2F%2Flocalhost%3A3000
ConsoleLogger.ts:99 [DEBUG] 57:50.69 Hub - Dispatching to auth with  {event: "signOut", data: null, message: "A user has been signed out"}
ConsoleLogger.ts:99 [DEBUG] 57:50.69 Hub - Dispatching to auth with  {event: "signOut", data: null, message: "A user has been signed out"}
ConsoleLogger.ts:99 [DEBUG] 57:50.69 Analytics - on hub capsule auth {event: "signOut", data: null, message: "A user has been signed out"}
ConsoleLogger.ts:99 [DEBUG] 57:50.70 Hub - Dispatching to auth with  {event: "signOut", data: null, message: "A user has been signed out"}
App.js:36 Hub signOut
App.js:80 render signedOut
App.js:80 render signIn
GET https://<domain>.auth.eu-west-2.amazoncognito.com/error?client_id=<clientid>&logout_uri=http%3A%2F%2Flocalhost%3A3000 400
Navigated to https://<domain>.auth.eu-west-2.amazoncognito.com/error?client_id=<clientid>&logout_uri=http%3A%2F%2Flocalhost%3A3000

Environment

npx envinfo --system --binaries --browsers --npmPackages --npmGlobalPackages

System:
OS: Linux 4.15 Ubuntu 18.04.4 LTS (Bionic Beaver)
CPU: (4) x64 Intel(R) Core(TM) i5-4570 CPU @ 3.20GHz
Memory: 737.01 MB / 15.58 GB
Container: Yes
Shell: 4.4.20 - /bin/bash
Binaries:
Node: 8.10.0 - ~/.nvm/versions/node/v8.10.0/bin/node
Yarn: 1.9.4 - /usr/bin/yarn
npm: 6.9.0 - ~/.nvm/versions/node/v8.10.0/bin/npm
Browsers:
Chrome: 80.0.3987.122
Firefox: 73.0.1
npmPackages:
@testing-library/jest-dom: ^4.2.4 => 4.2.4
@testing-library/react: ^9.4.1 => 9.4.1
@testing-library/user-event: ^7.2.1 => 7.2.1
aws-amplify: ^2.2.5 => 2.2.5
aws-amplify-react: ^3.1.6 => 3.1.6
react: ^16.13.0 => 16.13.0
react-dom: ^16.13.0 => 16.13.0
react-scripts: 3.4.0 => 3.4.0
npmGlobalPackages:
@aws-amplify/cli: 1.6.8
babel-eslint: 10.0.1
eslint-config-airbnb: 17.1.0
eslint-plugin-import: 2.16.0
eslint-plugin-jsx-a11y: 6.2.1
eslint-plugin-react-hooks: 1.7.0
eslint-plugin-react: 7.12.4
eslint: 5.13.0
npm: 6.9.0

[0xdevalias]

I've just hit what appears to be the same issue using withOAuth and Auth.signOut() using the preview version in #3365 (comment). It appears to sign my app out, then I end up back on the hosted login page with the following error:

[ngtrhieu]

Same problem on React Native. The auth events look sth like this:

Hub.listen('auth', ({ payload: { event, data } }) => {
  console.log(`event: ${event}`)
});

console log outputs:

<Click Sign In w FB -- Auth.federatedSignIn({provider: 'Facebook'})>
event: parsingCallbackUrl
event: parsingCallbackUrl
event: codeFlow
event signIn
event: cognitoHostedUI
<Sign in completed>

<Click Sign Out - Auth.signOut() >
event oAuthSignOut
<Immediately Amplify trying to sign in again - check screenshot>
<If click Continue - Required string parameter 'redirect_uri' - check screenshot>
<If click Cancel>
event signOut

[dev-elevate-usa]

I am having a similiar issue as listed above. As @ngtrhieu describes, the Alert is displaying Sign In when it is actually using the web browser of the device to call the url for the federated connection. I am not receiving the same error on the actual redirect page, as on my devices it just closes the web browser. Via the Hub, I am able to see that it is interpreting the first action as a "sign in" and then finishing with a a "sign out" after the browser has closed. Is there a manual way that we can call the endpoint programmatically so that the UI is not muddied up by this flow? My suggestion would be to implement a federatedSignOut function that will call the proper sign out URL for the social sign in.

[dibell]

@sammartinez Can you explain how this is a feature request? Is there a way to make this function correctly now?

[ogous]

I have faced same issue. Anybody figured out something new about it? I am on aws-amplify 3.1.1 and aws-amplify-react-native 4.2.5 and RN & Expo

[ogous]

@sammartinez this an ongoing issue, can you take a look?

[ogous]

@dibell this is feature request marked because, after federatedSingIn(FB, Google etc.) signOut browser redirect callback works presently as default(even if you don't use hostedUI). Only you can prevent signout Url. You could find details on #2115.

[abumere]

@oguzhanali Did you ever find a solution for this? The documentation does a terrible job at explaining this

[tomzaoral]

If you were following Amplify docs when building your app then you have probably forgot to handle signOut event in Hub.listener.

Checkout the docs https://docs.amplify.aws/lib/auth/social/q/platform/js#full-samples, lines 17-19.

It worked for me :) Hope it helps somebody else too.

[fruffin]

I am having the same problem in Vue app where after using Google login I can't sign out properly. Calling Auth.signOut redirects to the cognito logout page (which is expected) but immediately tries to sign in again instead of redirecting to my application, as shown in the original post.
Note that at that point I am effectively signed out as expected, but this cognito issue would really break the flow for our users.
Any idea?

[fruffin]

For anyone else facing this issue, my problem was that the logout URL set in the cognito client and in my app were using different casing... It didn't seem to bother Cognito for the sign in callback but it wasn't happy with the sign out callback.
So if you are seeing this issue, check that all references to the callback URLs are using the same case, same trailing slashes if any, etc...

[nadetastic]

I was able to reproduce this behavior with an older version of Amplify (aws-amplify": "^3.4.3") however as of V5, this doesn't appear to be happening. The underlying problem was most likely resolved at some point.

If you come across this problem and are using an older version, please update and test again - however if you continue to face the problem after upgrading please open a new issue, thanks!

[rafael-castelo]

Adding this code to the urlOpener method worked for me

if (url.includes('logout')) return null;