I work on a open-source web application (Moodle) which connects to a number of external services such as Google Drive, Dropbox etc. to allow users to exchange files with these services.

Primarily we are using OAuth based APIs to connect with these services. One of the user interaction problems we are facing is that our users do not expect that after they login to an external service that they stay logged into it. That sounds silly, but the scenario is this:

  1. User wants to get a file from their Google Drive account
  2. Moodle requests an oauth2 token from Google to browse google drive
  3. User is not logged into Google, so needs to login to Google
  4. Moodle gets token and user carries on their business in Moodle
  5. User logs out of Moodle and does not expect they are still logged into Google

My programmer viewpoint is that the browser session is completely the responsibility of user and that our application should not get involved. But we hear from our users about this misconception all the time. Its particularly a problem because our application is often used in shared environments.

Is there a good pattern for dealing with this problem which other applications use?

  • 1
    Since OAuth isn't an authentication protocol, I don't know of a way to force a logout beyond redirecting to Google's logout page. Other users of your site may not like the forced logout. I would include a note that they are still signed in to google with a link to the logout page. – Jay Lindquist Feb 20 '13 at 3:37
  • Yep, in fact i'd say most users wouldn't want a logout. – Dan Poltawski Feb 20 '13 at 3:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.