36

I am using openid to log the user in.(google account only). Now I have a sign out link in my page, which on clicking, I want the user to be logged out of google accounts and the page to be redirected to my home page. can this be done ??

Edit-
Changing the accepted answer because now Google allows redirecting [continuing] to any domain you want.

Shrinath
  • 7,888
  • 13
  • 48
  • 85

8 Answers8

67

I have solved this issue calling this function when the user click on the logout link:

var logout = function(){
document.location.href = "https://www.google.com/accounts/Logout?continue=https://appengine.google.com/_ah/logout?continue=http://www.example.com";
}

When the user click on the link, the browser redirect the user to the logout page and only when the logout is complete, the user is redirected to the site "http://www.example.com".

I hope this can help.

Cœur
  • 37,241
  • 25
  • 195
  • 267
ira
  • 866
  • 9
  • 10
  • OK, do you mean Google is now letting you "continue" into any domain? – Shrinath Mar 01 '13 at 09:08
  • I didn't try if it is possible to continue into ANY domain. I only tried with the domain from which the request was sent. – ira Mar 03 '13 at 13:38
  • @Shrinath: Yes, now google allows. So, this ans is the perfect way :-) – seoul Mar 11 '13 at 00:15
  • 7
    Using `appengine.google.com` as a middle man when doing the redirect back to your application works right now, but I cannot find any documentation for this endpoint. Use with caution. – ptz0n Nov 19 '13 at 13:12
  • Unfortunately, when using this URL with Google Chrome, and with a user logged in to Google Chrome, this also logs the user out of their chrome session - pausing the data sync. Not a good idea.... – Guss Sep 12 '18 at 18:42
  • 3
    This is not working any more. It is intended behavior, [please check this case for answer](https://stackoverflow.com/questions/54346026/https-appengine-google-com-ah-logout-still-working/55853066#55853066) – Pawel Czuczwara Apr 25 '19 at 15:46
  • how to avoid redirect notice page? – Manohar Pamishetty Jan 23 '23 at 06:57
19

Challenges

Requesting https://www.google.com/accounts/Logout will log the user out. There is a continueUrl parameter that Google adds to that address sometimes, but it will only succeed to redirect the user when the target is some Google site, and not your own. This makes the approach unusable.

Furthermore the OpenID specification does not include global log out at this moment.

There is another way:

Suggestion

Include an IFrame on your page and use the onClick JavaScript event handler on the logout link to load https://www.google.com/accounts/Logout into the IFrame. After that (you might want to check whether the IFrame loaded succesfully), redirect the user to a logout procedure for your own site. After logging out let that page redirect to your home page.

The link might look a bit like this:

<a href="https://www.google.com/accounts/Logout"
    onclick="myIFrame.location='https://www.google.com/accounts/Logout';StartPollingForCompletion();return false;">
   log out</a>
<iframe id="myIFrame"></iframe>

You need to implement the StartPollingForCompletion() function to periodically check whether the logout page has loaded. use setTimeout() to time the poll, and check for some property on the IFrame (I don't know for sure which ones will work, because you're working cross-site here).

see also these questions:

OpenID. How do you logout

How to add logout feature to an OpenID enabled site?

Community
  • 1
  • 1
Joseph Tanenbaum
  • 2,211
  • 15
  • 30
  • I am thinking of something like this : logout – Shrinath Nov 17 '10 at 08:57
  • Lol :D I had seen that stackoverflow's thread before.. I didn't get a proper answer there, and it was old, so opened a new one hoping to get an answer atleast after an year :D – Shrinath Nov 18 '10 at 04:45
  • 1
    btw, how do you suggest I implement that "StartPollingForCompletion()" ?? I am currently executing a redirect in javascript after 500ms, but I know that is blind.. – Shrinath Nov 18 '10 at 04:46
  • Checking anything relative to the state of such an iframe is likely to fail due to CORS (XSS) restrictions. – William Price May 20 '15 at 20:55
2

As I've spent a huge amount of time on this google login/logout issue for my app (which is a Node/MongoDB server, using massively Google Docs and Google Script APIs), I had to share my results here..

The only good way to completely logout the user is to use this :

 var newWindow = window.open('https://mail.google.com/mail/?logout&hl=fr','Disconnect from Google','width=100,height=50,menubar=no,status=no,location=no,toolbar=no,scrollbars=no,top=200,left=200');
setTimeout(function(){
    if (newWindow) newWindow.close();
    window.location="auth/google";
},3000);

If you use the solution gave above by ira, it is doing a partial logout it seems for the current tab of the browser. Meaning that if the user close the tab, and reopen the application, he will be still logged to the previous account.

I had to use an external window because I was not able to redirect correctly to my app after logout from email google account. This solution works most of times, if user bandwidth is not too slow, letting 3 seconds to the logout being done before closing the popup. Then user is required to log with another account in my main window app.

This confirms the solution of floccinaucinihilipilification and maybe the iframe solution given above should be better than mine.

Cédric NICOLAS
  • 1,006
  • 2
  • 12
  • 24
  • Elegant solution here - working nicely. Seems to be "*cleaner & lighter*" than having to manage an iframe and all the stuff that goes with that – Gene Bo Jun 27 '18 at 20:46
1

Here's what I do, don't recall if I made it up or found it somewhere... It works like a charm... other than the fact that it logs out you out of all Google sites (I can't believe they don't provide a proper way to do it, but there you go.)

<script>
function makeFrame(domId,url) { 
    ifrm = document.createElement("IFRAME"); 
    ifrm.setAttribute("src", url);
    ifrm.setAttribute("id", domId);
    ifrm.setAttribute("style", "display:none;");         
    ifrm.style.width = 1+"px"; 
    ifrm.style.height = 1+"px"; 
    document.body.appendChild(ifrm); 
} 

function logOutGoogle(){
    makeFrame('googleLogoutIFrame','https://www.google.com/accounts/Logout');
}
$(window).ready(function() {
    logOutGoogle();
});
</script>
Quinxy von Besiex
  • 976
  • 11
  • 21
  • It worked perfectly with my requirement i want to programmatically call logout without knowing user or any kind of popup. Your solution worked for me. One thing i want to add after document.body.appendChild(ifrm) we can add const nodes = document.querySelectorAll('iframe'); nodes.forEach((node) => node.parentNode.removeChild(node)); to remove iframes which are not useful. – Trinu Jan 11 '22 at 16:47
1

I have been trying to do the same. For google apps only -
To logout try the following two options:
1) Using i-frame -

<iframe src="https://mail.google.com/a/YOURDOMAIN.IN/?logout&hl=en" width="100%" height="300">
  <p>Your browser does not support iframes.</p>
</iframe>

2) Using Javascript -

<script type="text/javascript">
     window.open('https://mail.google.com/a/YOURDOMAIN.IN/?logout&hl=en','logout_from_google','width=600,height=300,menubar=no,status=no,location=no,toolbar=no,scrollbars=no,top=20,left=20');
</script>
  • sorry dude, this thread is answered long back, and he had suggested the iframe method which I used on that project... Thanks for your valuable time :) – Shrinath Feb 14 '11 at 12:18
  • Hi. Could u tell me how u did this ? What I want to do is send a hidden request to log out the user from google acccount and then take him to any php page I want. Please help ! – Floccinaucinihilipilification. Feb 15 '11 at 08:33
1

I use this code to log out from google account. It will throw an error but don't worry, it will be redirected immediately after the error takes place directly to your application server-side signout route.

<a href="https://www.google.com/accounts/Logout" target="myiframe">logout</a>
<iframe name="myiframe" style="display:none" onload="redirect()"></iframe>

<script>
  function redirect() {
    window.location = 'http://your.site.com/signout';
  };
</script>
yohanes
  • 2,365
  • 1
  • 15
  • 24
0

I just had to do the same, logout the user. somehow the accepted answer doesn't work for me, I got an error from google

The page you requested is invalid.

so I ended up putting this into my page:

<img src="https://www.google.com/accounts/Logout" />

which successfully logs out the user. source

Community
  • 1
  • 1
balazs
  • 5,698
  • 7
  • 37
  • 45
0

I don't know if the thing I did was right. But I managed to use code like this:

<a class="btn btn-default navbar-btn text-white" id="signOut" href="../home.html" onclick="signOut('https://www.google.com/accounts/Logout');">Sign out</a>
    <script>
      function signOut() {
        var auth2 = gapi.auth2.getAuthInstance();
        auth2.signOut().then(function () {
          console.log('User signed out.');
        });
      }
      firebase.auth().signOut().then(function() {
        // Sign-out successful.
        alert('You have Signed Out. Please Sign In');
      }).catch(function(error) {
        // An error happened.
        alert('An error happened');
      });
    </script>
Dmitriy
  • 5,525
  • 12
  • 25
  • 38