Take the 2-minute tour ×
Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. It's 100% free, no registration required.

I work on a open-source web application (Moodle) which connects to a number of external services such as Google Drive, Dropbox etc. to allow users to exchange files with these services.

Primarily we are using OAuth based APIs to connect with these services. One of the user interaction problems we are facing is that our users do not expect that after they login to an external service that they stay logged into it. That sounds silly, but the scenario is this:

  1. User wants to get a file from their Google Drive account
  2. Moodle requests an oauth2 token from Google to browse google drive
  3. User is not logged into Google, so needs to login to Google
  4. Moodle gets token and user carries on their business in Moodle
  5. User logs out of Moodle and does not expect they are still logged into Google

My programmer viewpoint is that the browser session is completely the responsibility of user and that our application should not get involved. But we hear from our users about this misconception all the time. Its particularly a problem because our application is often used in shared environments.

Is there a good pattern for dealing with this problem which other applications use?

share|improve this question
    
Since OAuth isn't an authentication protocol, I don't know of a way to force a logout beyond redirecting to Google's logout page. Other users of your site may not like the forced logout. I would include a note that they are still signed in to google with a link to the logout page. –  Jay Lindquist Feb 20 '13 at 3:37
    
Yep, in fact i'd say most users wouldn't want a logout. –  Dan Poltawski Feb 20 '13 at 3:43

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.