{"action":"created","issue":{"url":"https://api.github.com/repos/box/box-android-sdk/issues/379","repository_url":"https://api.github.com/repos/box/box-android-sdk","labels_url":"https://api.github.com/repos/box/box-android-sdk/issues/379/labels{/name}","comments_url":"https://api.github.com/repos/box/box-android-sdk/issues/379/comments","events_url":"https://api.github.com/repos/box/box-android-sdk/issues/379/events","html_url":"https://github.com/box/box-android-sdk/issues/379","id":339242174,"node_id":"MDU6SXNzdWUzMzkyNDIxNzQ=","number":379,"title":"Android Box SSO not logging out","user":{"login":"boyhasnoname","id":411364,"node_id":"MDQ6VXNlcjQxMTM2NA==","avatar_url":"https://avatars0.githubusercontent.com/u/411364?v=4","gravatar_id":"","url":"https://api.github.com/users/boyhasnoname","html_url":"https://github.com/boyhasnoname","followers_url":"https://api.github.com/users/boyhasnoname/followers","following_url":"https://api.github.com/users/boyhasnoname/following{/other_user}","gists_url":"https://api.github.com/users/boyhasnoname/gists{/gist_id}","starred_url":"https://api.github.com/users/boyhasnoname/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/boyhasnoname/subscriptions","organizations_url":"https://api.github.com/users/boyhasnoname/orgs","repos_url":"https://api.github.com/users/boyhasnoname/repos","events_url":"https://api.github.com/users/boyhasnoname/events{/privacy}","received_events_url":"https://api.github.com/users/boyhasnoname/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2018-07-08T17:20:47Z","updated_at":"2018-07-08T18:42:29Z","closed_at":null,"author_association":"NONE","body":"Hi Team,\r\nRecently we found an issue that, BoxSession.logout() api is not clearing the SSO cache. User can able to access the box files using SSO even though he logged out from Box. Could you let us know your comments? \r\n\r\n1. Login Box using SSO\r\n2. Enter email -> Submit -> Enter Username/Password -> Authentication success -> Able to access files\r\n3. Logout Box using BoxSession.logout() -> Login again using SSO -> Enter Email -> Submit -> Entering into Box Files activity without asking the user credentials."},"comment":{"url":"https://api.github.com/repos/box/box-android-sdk/issues/comments/403307392","html_url":"https://github.com/box/box-android-sdk/issues/379#issuecomment-403307392","issue_url":"https://api.github.com/repos/box/box-android-sdk/issues/379","id":403307392,"node_id":"MDEyOklzc3VlQ29tbWVudDQwMzMwNzM5Mg==","user":{"login":"doncung","id":624482,"node_id":"MDQ6VXNlcjYyNDQ4Mg==","avatar_url":"https://avatars2.githubusercontent.com/u/624482?v=4","gravatar_id":"","url":"https://api.github.com/users/doncung","html_url":"https://github.com/doncung","followers_url":"https://api.github.com/users/doncung/followers","following_url":"https://api.github.com/users/doncung/following{/other_user}","gists_url":"https://api.github.com/users/doncung/gists{/gist_id}","starred_url":"https://api.github.com/users/doncung/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/doncung/subscriptions","organizations_url":"https://api.github.com/users/doncung/orgs","repos_url":"https://api.github.com/users/doncung/repos","events_url":"https://api.github.com/users/doncung/events{/privacy}","received_events_url":"https://api.github.com/users/doncung/received_events","type":"User","site_admin":false},"created_at":"2018-07-08T18:42:29Z","updated_at":"2018-07-08T18:42:29Z","author_association":"CONTRIBUTOR","body":"The logout will only work on currently logged in accounts. However the\nwebview will cache sso credentials for some time by default. The sdk should\nbe clearing on disk cache, but the OS could keep something in memory. Does\nkilling the app and restarting not log you in?\n\nOn Sun, Jul 8, 2018, 10:20 AM BoyHasNnoName <notifications@github.com>\nwrote:\n\n> Hi Team,\n> Recently we found an issue that, BoxSession.logout() api is not clearing\n> the SSO cache. User can able to access the box files using SSO even though\n> he logged out from Box. Could you let us know your comments?\n>\n>    1. Login Box using SSO\n>    2. Enter email -> Submit -> Enter Username/Password -> Authentication\n>    success -> Able to access files\n>    3. Logout Box using BoxSession.logout() -> Login again using SSO ->\n>    Enter Email -> Submit -> Entering into Box Files activity without asking\n>    the user credentials.\n>\n> —\n> You are receiving this because you are subscribed to this thread.\n> Reply to this email directly, view it on GitHub\n> <https://github.com/box/box-android-sdk/issues/379>, or mute the thread\n> <https://github.com/notifications/unsubscribe-auth/AAmHYkhv7S3XgAcCeuGymoHiPWbu7RKaks5uEj9vgaJpZM4VGzPV>\n> .\n>\n"}}
{"actor":{"display_login":"doncung"}}