title: Google Identity Services implement manual and automatic signout function
body: <p>I'm using Google's Identity Services for the Signin button: <a href="https://developers.google.com/identity/gsi/web/guides/personalized-button" rel="nofollow noreferrer">https://developers.google.com/identity/gsi/web/guides/personalized-button</a></p>
  <p>Now once a user logins to my website via Google I also trigger my own website's authentication mechanism (Forms login via ASP.NET). After 60 minutes of inactivity the user is automatically signed out of my application. However, the Google signin button still shows that user's email address.
  With a single click another user on that same machine could now relogin to my website as Google does not ask to authenticate again. Which seems like a weird design, but I'm probably missing something.
  How can I both automatically (in my case 60 minutes) expire the Google login and manually - when user clicks signout on my website - signout from Google?</p>
  <p>I checked <a href="https://stackoverflow.com/questions/53233459/signing-out-of-website-using-google-sign-in-button">here</a>, but that's not a solid solution it seems.
  I also checked <a href="https://stackoverflow.com/questions/46674220/google-identity-api-signout-explained">here</a> (old post) and <a href="https://developers.google.com/identity/sign-in/web/sign-in" rel="nofollow noreferrer">here</a>, but when placing the mentioned signout code example I get error</p>
  <blockquote>
  <p>Uncaught ReferenceError: gapi is not defined</p>
  </blockquote>
  <p>Even though I load the <code>https://accounts.google.com/gsi/client</code> script synchronously. Also I don't think the <code>gapi</code> still applies with the new Google Identity Services.</p>
  <pre><code>&lt;meta name=&quot;google-signin-scope&quot; content=&quot;profile email&quot;&gt;
  &lt;meta name=&quot;google-signin-client_id&quot; content=&quot;MYAPPIDPLACEHOLDER.apps.googleusercontent.com&quot;&gt;
  
  
     function handleCredentialResponse(response) {
          var xhr = new XMLHttpRequest();
          xhr.onreadystatechange = function () {
              if (xhr.readyState === 4) {
                  var result = JSON.parse(xhr.response).result;
                  if (result == 'ok') {
                      window.location.href = &quot;https://www.example.com&quot;;
                  }
              }
          }
          //here I check the validity of the token
          xhr.open('POST', 'https://www.example.com/api/gtokensignin');
          xhr.setRequestHeader('Content-Type', 'application/json'); 
          xhr.send(JSON.stringify({ &quot;idtoken&quot;: response.credential}));
      }
      
      
  &lt;div id=&quot;g_id_onload&quot;
       data-client_id=&quot;MYAPPIDPLACEHOLDER.apps.googleusercontent.com&quot;
       data-context=&quot;signin&quot;
       data-ux_mode=&quot;popup&quot;
       data-callback=&quot;handleCredentialResponse&quot;
       data-nonce=&quot;&quot;
       data-auto_prompt=&quot;false&quot;
       data-auto_select=&quot;true&quot;&gt;
  &lt;/div&gt;
      
  &lt;div class=&quot;g_id_signin&quot;
       data-type=&quot;standard&quot;
       data-shape=&quot;rectangular&quot;
       data-theme=&quot;outline&quot;
       data-text=&quot;signin_with&quot;
       data-size=&quot;large&quot;
       data-logo_alignment=&quot;left&quot;&gt;
  &lt;/div&gt;  
  </code></pre>
  <p><strong>example.svc.vb</strong></p>
  <p>This code successfully retrieves user details based on Google id_token</p>
  <pre><code>Public Function gtokensignin(ByVal str As oAuthUserSigninDetails) As Stream Implements Iexample.gtokensignin
  
      Dim dDateTimeNow As DateTime = DateTime.UtcNow
  
      Dim resultBytes As Byte()
      Dim resultText As String = &quot;false&quot;
  
      Dim WC As New WebClient
      Dim json As String
  
      Try
          json = WC.DownloadString(&quot;https://oauth2.googleapis.com/tokeninfo?id_token=&quot; + str.idtoken)
      Catch ex As Exception
          Exit Function
      End Try
  
      Dim obj As JObject = JObject.Parse(json)
  
      Dim iss As String = obj.Item(&quot;iss&quot;)
      Dim azp As String = obj.Item(&quot;azp&quot;)
      Dim aud As String = obj.Item(&quot;aud&quot;)
  
      Dim exp As Long = Long.Parse(obj.Item(&quot;exp&quot;)) * 1000 'convert to milliseconds
      Dim expirationDate As DateTime = DateTimeOffset.FromUnixTimeMilliseconds(Long.Parse(exp)).UtcDateTime
  
      Dim email As String = obj.Item(&quot;email&quot;)
  
  End Function
  </code></pre>
  <p><strong>UPDATE 1</strong></p>
  <p>Ok, so I tried @Transformer's (see below) code in an incognito browser instance to make sure my Google Chrome login does not muddy the test.</p>
  <p>Steps and questions regarding your OPTION 1:</p>
  <ol>
  <li>Why do you use <a href="https://apis.google.com/js/platform.js" rel="nofollow noreferrer">https://apis.google.com/js/platform.js</a> instead of <a href="https://accounts.google.com/gsi/client" rel="nofollow noreferrer">https://accounts.google.com/gsi/client</a> (as described <a href="https://developers.google.com/identity/gsi/web/guides/display-button#html" rel="nofollow noreferrer">here</a>), <code>platform.js</code> is the <a href="https://developers.google.com/identity/gsi/web/guides/migration" rel="nofollow noreferrer">old way of doing things</a>.</li>
  <li>After clicking the signin button I have to enter my password. I login successfully and the Google button displays my email address</li>
  <li>I fire my <code>signOut()</code> function and see logged to Google Chrome console &quot;User signed out.&quot;</li>
  <li>I refresh the page but still see my email address in the Google button and when I click it, I'm also signed in without having to enter my password again. Is this by design and if so: why would Google offer anyone the option to simply signin again without re-authenticating?</li>
  </ol>
  <p>Steps and questions regarding your OPTION 2:</p>
  <ol>
  <li>I logout via my own link &quot;https://www.google.com/accounts/Logout?continue=https://appengine.google.com/_ah/logout?continue=https://www.example.com?signout=yes&quot;
  2a. IF I'm in an incognito browser window I get a Google redirect screen &quot;the page is trying to redirect you to example.com&quot;, if I do so, I'm successfully logged out. Is there a way to NOT show that redirect screen?
  2b. IF I'm in a regular Chrome browser window, I'm redirected to my employer's SSO provider login page and NOT back to my personal website example.com. I presume because we also use Google accounts internally, how to control that?</li>
  </ol>
  <p>IMPORTANT NOTE: I also get signed out of my Gmail account, where I just want to logout the Google session with my website and require user to re-authenticate upon logging in again. I'm not sure if this is the way Google intended this feature though.</p>