I work on a open-source web application (Moodle) which connects to a number of external services such as Google Drive, Dropbox etc. to allow users to exchange files with these services.
Primarily we are using OAuth based APIs to connect with these services. One of the user interaction problems we are facing is that our users do not expect that after they login to an external service that they stay logged into it. That sounds silly, but the scenario is this:
- User wants to get a file from their Google Drive account
- Moodle requests an oauth2 token from Google to browse google drive
- User is not logged into Google, so needs to login to Google
- Moodle gets token and user carries on their business in Moodle
- User logs out of Moodle and does not expect they are still logged into Google
My programmer viewpoint is that the browser session is completely the responsibility of user and that our application should not get involved. But we hear from our users about this misconception all the time. Its particularly a problem because our application is often used in shared environments.
Is there a good pattern for dealing with this problem which other applications use?