I am currently integrating Frappe OAuth2 into a React Native mobile application. I have the basic authentication flow working, but I am struggling with “User Switching.”
When a user logs out of the mobile app and tries to log back in (or switch to a different account), the system’s browser (used for the OAuth flow) still holds the session cookie from the previous user. This causes the app to automatically log in the previous user without prompting for credentials.
Currently, the only way to switch users is to manually open the mobile browser, go to the Frappe site, and click “Logout” there, which is a poor user experience.
What I need:
I want to force the Frappe login page to appear every time the OAuth flow is initiated from the mobile app, regardless of whether a session cookie exists in the browser.
Any guidance on the standard way to handle “Force Login” for mobile clients would be greatly appreciated!
we use mobile app as well but what we do is to use secrete keys , then each time we login into the system , we fetch all users to localhost db for the mobile app , each time on login system will check if user exists in the local db and if not does not allows thus does not rely on frappe webbrowser auth
This needs to be fixed at the framework level - there’s a checkbox in the OAuth Client that requires a second step, but that page itself doesn’t have a logout button.
Quick fix for now would be to keep a low session timeout in System Settings - but this would affect all users, not just mobile app users
Also, do not store API keys in local storage - this is highly insecure.
Thanks! I tried prompt=login in my request, but the issue is the browser session cookie. After logout from the app, the browser still holds the previous user’s session, so it skips the login page entirely and logs in as the previous user automatically — no credentials prompt at all. so the cookie always carries over.
In most oidc providers the login page is shown as soon as prompt=login is set. Session does not interfere with showing login page.
Frappe cannot do that because as long as you are in session the login page will redirect-to the login query param which is what is set on oauth2 authorize.
One options here is to check for the request for prompt=login in frappe.integrations.oauth2.authorize and logout user, and let the guest redirect continue. Also need to check if prompt=login should be popped off after logout? or it will get in a loop where prompt=login will always logout and oauth2 flow will not proceed.
other option is to allow showing login page to logged in user.
Both you can do in custom app by overriding www/login.py page or hook for frappe.integrations.oauth2.authorize function to have custom logic.