Unable to restore a soft-logged-out session established via SSO

[richvdh]

Steps to reproduce

1. Log into Element via SSO
2. Have the session be soft-logged-out

Outcome

What did you expect?

I expect to be able to restore the session via another SSO login.

What happened instead?

An error saying "You cannot sign in to your account":

Operating system

No response

Application version

current develop (Element version: d1f7b08-react-4a9c4198b080-js-55b9116c998b Olm version: 3.2.14 or so)

How did you install the app?

No response

Homeserver

Synapse 1.90

Will you send logs?

No

[richvdh]

This happens due to bugs in SoftLogout. In particular:

First, it inspects realQueryParams. These are the query parameters at the time the app was loaded. Since we logged in via token login, an (old) loginToken is present.

It then goes on to inspect localstorage for the URL of the homeserver that the loginToken belongs to (https://github.com/matrix-org/matrix-react-sdk/blob/v3.77.1/src/components/structures/auth/SoftLogout.tsx#L193). That setting was cleared when we did the token login.

So, it declares the situation to be untenable and shows the above error.

---

It's actually fine if there is an app reload between the initial login (or renewal) and the soft-logout.

[richvdh]

matrix-org/matrix-react-sdk#11402 adds a cypress test which has to work around this.

[richvdh]

I'm going to bump the severity on this. It's awful experience if you hit it because you end up vaping your crypto state.

[remyb-SURF]

We're also running into this issue, after querying in #element-web:matrix.org @t3chguy replied the following:

---

from a quick skim it seems to be thinking you're returning from your SSO provider when you hit soft logout hence the log message you're seeing, this also ends up resulting in not showing you the SSO button

trySsoLogin fails because you haven't gone via SSO yet to re-auth
it doesn't feel like that return should be there if trySsoLogin fails

Index: src/components/structures/auth/SoftLogout.tsx
IDEA additional info:
Subsystem: com.intellij.openapi.diff.impl.patch.CharsetEP
<+>UTF-8
===================================================================
diff --git a/src/components/structures/auth/SoftLogout.tsx b/src/components/structures/auth/SoftLogout.tsx
--- a/src/components/structures/auth/SoftLogout.tsx	(revision 4796b79d98a5dd2c07bd54e3ea312066806b2fb8)
+++ b/src/components/structures/auth/SoftLogout.tsx	(date 1693907928260)
@@ -117,8 +117,9 @@
         const hasAllParams = queryParams?.["loginToken"];
         if (hasAllParams) {
             this.setState({ loginView: LoginView.Loading });
-            this.trySsoLogin();
-            return;
+            if (await this.trySsoLogin()) {
+                return;
+            }
         }
 
         // Note: we don't use the existing Login class because it is heavily flow-based. We don't
@@ -186,14 +187,14 @@
         });
     };
 
-    private async trySsoLogin(): Promise<void> {
+    private async trySsoLogin(): Promise<boolean> {
         this.setState({ busy: true });
 
         const hsUrl = localStorage.getItem(SSO_HOMESERVER_URL_KEY);
         if (!hsUrl) {
             logger.error("Homeserver URL unknown for SSO login callback");
             this.setState({ busy: false, loginView: LoginView.Unsupported });
-            return;
+            return false;
         }
 
         const isUrl = localStorage.getItem(SSO_ID_SERVER_URL_KEY) || MatrixClientPeg.safeGet().getIdentityServerUrl();
@@ -209,7 +210,7 @@
         } catch (e) {
             logger.error(e);
             this.setState({ busy: false, loginView: LoginView.Unsupported });
-            return;
+            return false;
         }
 
         Lifecycle.hydrateSession(credentials)
@@ -220,6 +221,7 @@
                 logger.error(e);
                 this.setState({ busy: false, loginView: LoginView.Unsupported });
             });
+        return true;
     }
 
     private renderPasswordForm(introText: Optional<string>): JSX.Element {

something like the above might fix it

[Johennes]

I'm adding the OIDC label to this issue as I'd like us to explore whether we could feasibly fix this in the course of https://github.com/vector-im/element-internal/issues/412 (the label gets the issue on the respective board).

CC @kittykat / @kerryarchibald

[Johennes]

@kerryarchibald sorry I realised I hadn't actually added this to your OIDC board. Could you give it a look?