Log Out when Nextcloud logs out

[jonathanmmm]

Hi,

right now I am using both nextcloud and this app via OIDC (OpenID Connect), the iframe problem is still a problem, don't know why, put the frame-src into keycloak and nginx, but didn't work.

But the more problematic thing is, that synapse doesn't automatically logs sessions out, so when I log out with the nextcloud account and somebody else goes onto the computer and into the browser and logs into with their nextcloud account they are logged in into my messages.
Is it possible to send a logout message to synapse/matrix when nextcloud is logged out?

This feature request tries the complete opposite, so maybe this should be a toggle (on by default to log you out, as it is much more secure).
#114

[gary-kim]

That's strange, when a user logs out of Nextcloud, their session data should be deleted.

https://github.com/nextcloud/server/blob/71109b74259fdc5ec78e278d1674cf314c414ae1/core/src/login.js#L35-L44

[gary-kim]

A possible issue might be that indexedDB data is not cleared. Let's see if that can be cleared on logout

[jonathanmmm]

Can I help you somehow to debug this?

[jonathanmmm]

Maybe it is about cookies that are not deleted, I logged out and 9 cookies left on nextcloud, maybe it is because the website tries OIDC in iFrame and it fails and opens the full frame website. If I then go in to a new tab or back and log out I can't access it initially, but logging in with whatever account into nextcloud gives me access to the chats of the logged in person.

This means: If I log in on the computer of some college (if used in a company) and log out again and he logs into his nextcloud account he can see my chats and write as he was me.
This is serious, as you think, logging out means logging out. And nobody will find this by their own, as they only log in with their own account.

[gary-kim]

What I'm thinking is we can set up an extra script loaded on logout that also deletes indexedDB data. That is where Element stores the access token.

[jonathanmmm]

Maybe, could you reproduce this security bug? If I can assist, let me know, I could give you a dummy account on my server.

Also does this version of Element deletes the encrytion key for E2EE chats, are these somehow saved in nextcloud? If yesy the E2EE would be broken (aa the server has the keys).

[gary-kim]

E2EE keys are kept in indexedDB storage on the client and are never sent to the Nextcloud server.

Feel free to reopen the issue if #383 hasn't fixed your issue.

[jonathanmmm]

@gary-kim Sadly it didn't fix the issue. I first thought as I am using OpenID Connect and he makes the website fullscreen (after first login doesn't work), that it is about the cookies the browser saved from matrix.my-domain.com (that got saved) instead of nextcloud.my-domain.com but after logout, closing, new window, logging in with another account I am logged in (in frame) with the first account.

After login again I have the following cookes, all for nextcloud.my-domain.com:
Cookies for matrix.my-domain.com where gone.

__Host-nc_sameSiteCookielax: true
__Host-nc_sameSiteCookiestrict: true 
ocSomeString: someString
oc_session_passphrase: someString
one entry for indexed database nextcloud.my-domain.com
one entry for local storage nextcloud.my-domain.com
same for service worker and session storage (Sitzungsspeicher).

I can send you two credentials for test accounts at my server and you can try. Or what information would be useful to debug it?

[jonathanmmm]

I am doing this whole thing in icognito mode in the new Edge Browser with moderate tracker settings (default).
I closed the icognito windows and opened and logged into both accounts (and closing after each) and was not logged into element anymore (synapse may still think the session exists, but I was greeted with the login screen of element), so it seems to be something that is saved in the browser and not on the server.