Azure AD B2C - other browsing sessions still active after logout

user_6553492 0
Viewed 409

I have a single-page web application secured by Azure AD B2C.

When a user logs out of my web application, I want the user to be logged out of other instances of the app that they might be logged in to.

What appears to be happening is that even after the user logs out, they are able to keep using sessions in other browsers. The user is able to redeem a new access token from a refresh token issued before the logout event. This access token can then be used to access the backend API.

My web app is using the @azure/msal-browser library and I am using the logoutRedirect function. This is correctly redirecting to the /oauth2/v2.0/logout URL for my AD B2C tenant and policy, and clearing the tokens from browser storage.

In addition to logoutRedirect I am also calling the Microsoft Graph API endpoints revokeSignInSessions and invalidateAllRefreshTokens for the user as part of the logout process.

My understanding is that this process should be enough to invalidate the refresh tokens for that user, meaning that after the currently active access token expires (after 5 minutes in my case) then the request to the token endpoint should fail, meaning that the user must log in again to get a new access token.

However, the request to token succeeds and the user is able to retrieve a new token access and continue using my web app and API. This does not seem right.

I tried the same experiment against 'plain' Azure AD and it worked exactly as expected: after log out, previously issued refresh tokens were invalidated immediately.

How can I achieve logout across browser sessions in AD B2C?

EDIT: I am using built-in policies rather than custom policies - and I would prefer to keep it that way if possible.

msal azure-ad-b2c
1 Answers

Please check if this is your case.

  1. In some cases appears that when the logout is sent to B2C, it does not invalidate the session on the B2C server,As Web sessions that are created within 10 seconds prior to revoking the refresh token will continue to be valid.So anyone with that session cookies can use the app the same way. This can be mitigated by setting the session timeout to 15 mins as this is the lowest time set.
  2. Also please note that it may not be possible to clear login session completely for external AD login from b2c app. AD login i.e.; socialaccount login creates a persistent cookie under login.microsoftonline.com domain on the browser. This cookie cannot be cleared by b2c as its under different domain.
  3. Try with Frontchannel logout uri for the application in azure ad b2c which enables single signout In your application, create a dedicated logout page. Use this in front channel logout uri.
user_159975090
Related