Solid authenication doesn't work between examples

[NoelDeMartin]

As noticed by @bourgeoa, when you log into one of the Solid examples, you can't use the other ones without logging out first.

I'm not sure there's an easy way to solve this problem without complicating in excess, but at least we can have this issue open in case someone stumbles upon the problem.

[rosano]

Interesting. If there's a simple explanation for why, I'd be curious to know.

[NoelDeMartin]

I think the explanation is that the authentication library stores data under localStorage, and given that the applications are run on the same domain (hello.0data.app, localhost:3000, etc.), the storage is shared so it thinks that you're logged in and takes you back to the original url you logged in from (hello.0data.app/solid/solid-rest-api, localhost:3000/solid/solid-rest-api, etc.). It's generally a bad idea to serve multiple apps from the same domain (I've made that mistake myself), but for this examples it may be overkill to have a subdomain per each one

[rosano]

Ok, I misunderstood it as the opposite… After logging in with the REST example and viewing solid-file-client, it 'automatically presents the data from my account'—I actually like this and would consider it a feature as it demonstrates fluidity despite using different approaches.

[NoelDeMartin]

I actually like this and would consider it a feature as it demonstrates fluidity despite using different approaches.

I'm not sure if we're still understanding each other. When you log into the REST API example, if you then try to use the solid-file-client example you'll be redirected to your identity provider and then back to the REST API example. So you won't be able to use the solid-file-client example without logging out from the REST API first, and the problem is that since the UI is the same maybe you don't even notice.

Given that this is targeted to developers understanding the code, and possibly tinkering with it, I think that's a problem.

[bourgeoa]

Could we try to automatically logout when leaving a solid page app ?

[rosano]

I'm not sure if we're still understanding each other. When you log into the REST API example, if you then try to use the solid-file-client example you'll be redirected to your identity provider and then back to the REST API example. So you won't be able to use the solid-file-client example without logging out from the REST API first, and the problem is that since the UI is the same maybe you don't even notice.

Whoops, that's exactly what happened! Nevermind what I said.

[uvdsl]

Hi 👋, I thought I'd chime in and note that the redirect issue is not a problem when the authentication library uses the Refresh Token Flow to re-establish a session. @uvdsl/solid-oidc-client-browser (my implementation) does so, for example. Also, it uses sessionStorage rather than localStorage - so you can have distinct sessions in different tabs. If you stay in the same tab, and reload a different path on the same origin, then you will automatically be logged in using the previous session (see this minimal example).

This may, however, result in a security issue if you require your apps to have distinct client_ids. If this is the case, please see the security considerations.