Web - SSO - Unable to sign out

[jponikarchuk]

If you haven’t already, check out our contributing guidelines for onboarding and email contributors@expensify.com to request to join our Slack channel!

---

Version Number: v9.3.41-0
Reproducible in staging?: Yes
Reproducible in production?: Unable to validate in Prod - Provide reasoning.
If this was caught during regression testing, add the test name, ID and link from BrowserStack: #83440
Email or phone of affected tester (no customers): applausetester+saml1@applause.expensifail.com
Issue reported by: Applause Internal Team
Bug source: Pull Request QA execution
Device used: Windows 11, Chrome
App Component: Other

Action Performed:

1. Sign in via SSO (you can use applausetester+saml1@applause.expensifail.com)
2. Click Account > Sign out

Expected Result:

When sign in via SSO, the user should be able to sign out successfully.

Actual Result:

When attempting to sign out after signing in via SSO, a new browser window opens and redirects to OD. If you close this window and click 'Sign out' again, an unknown error 500 is displayed.

Workaround:

Unknown

Platforms:

• Android: App
• Android: mWeb Chrome
• iOS: App
• iOS: mWeb Safari
• iOS: mWeb Chrome
• Windows: Chrome
• MacOS: Chrome / Safari

Screenshots/Videos

Video.mp4

View all open jobs on GitHub

Issue Owner

Current Issue Owner: @jnowakow

[melvin-bot]

You have been assigned to this deploy blocker because you recently merged this PR: #83440

[melvin-bot]

💬 A slack conversation has been started in #expensify-open-source

[github-actions]

👋 Friendly reminder that deploy blockers are time-sensitive ⏱ issues! Check out the open `StagingDeployCash` deploy checklist to see the list of PRs included in this release, then work quickly to do one of the following:

1. Identify the pull request that introduced this issue and revert it.
2. Find someone who can quickly fix the issue.
3. Fix the issue yourself.

[OSBotify]

🔍 Investigation Summary

Classification: Backend bug
Causing PR: Unable to identify an App PR that caused this issue (High confidence)
Related Issues: #83056

Recommendation: NEEDS INVESTIGATION

This appears to be a backend API issue, not a frontend bug. The App repository does not contain code that would cause a 500 server error during SAML sign-out on web.

Labels: Removing DeployBlockerCash label as this is not an App deploy blocker. Keeping DeployBlocker as this blocks the backend/web deploy.

📋 Detailed Analysis

Evidence

The issue reports:

1. Platform: Web (Windows Chrome)
2. Symptom: After signing in via SSO, clicking sign out opens a browser window that redirects to OldDot
3. If the user closes that window and clicks sign out again, an "unknown error 500" is displayed

PR #83440 was initially suspected because:

• The issue was caught during regression testing of that PR
• The PR modifies SSO sign-out behavior

However, PR #83440 only affects HybridApp (mobile apps), not web.

Verification

I verified that PR #83440 cannot affect web:

1. Files modified by PR Prevent OD api calls during SSO sign out #83440:

   • modules/hybrid-app/** - HybridApp module files (mobile only)
   • src/libs/actions/Session/index.ts - Added calls to HybridAppModule.startSignOut() and HybridAppModule.cancelSignOut()

2. Critical finding: The changes in Session/index.ts are gated by CONFIG.IS_HYBRID_APP:

   if (CONFIG.IS_HYBRID_APP) {
       HybridAppModule.cancelSignOut();
   }

3. CONFIG.IS_HYBRID_APP on web: In /home/runner/_work/App/App/src/CONFIG.ts line 138:

   IS_HYBRID_APP: HybridAppModule.isHybridApp()

   The HybridAppModule.isHybridApp() method returns false on web (see /home/runner/_work/App/App/modules/hybrid-app/src/index.ts line 5).

4. Conclusion: The new code paths added by PR Prevent OD api calls during SSO sign out #83440 are never executed on web.

Root Cause

The "unknown error 500" is a server-side error returned by the backend API. The most likely scenarios:

1. The SAML logout endpoint (/authentication/saml/logout) is returning a 500 error on subsequent sign-out attempts
2. The LOG_OUT API endpoint is returning a 500 error in certain conditions

The App code is functioning as designed - it calls the backend API, which returns a 500 error. The fix needs to happen in the backend code that handles SAML sign-out, not in the App repository.

Next Steps

1. Backend team should investigate the SAML sign-out flow to determine why a 500 error is returned on subsequent sign-out attempts
2. Check backend logs for the error details when the 500 error occurs
3. Consider if there is state on the backend that is not properly cleaned up after the first (cancelled) sign-out attempt

[MelvinBot]

Proposal

Please re-state the problem that we are trying to solve in this issue.

When a user signs in via SSO (SAML) on Web and clicks "Sign out," a popup browser window opens and redirects to OldDot. If the user closes this window and clicks "Sign out" again, an unknown error 500 is displayed. The user cannot sign out.

What is the root cause of that problem?

The root cause is in how callSAMLSignOut handles the web platform at src/libs/actions/Session/index.ts:254-271.

When an SSO user clicks Sign Out on web:

1. callSAMLSignOut calls openAuthSessionAsync from expo-web-browser, which opens a popup window (via window.open()) to the SAML logout URL at https://www.expensify.com/authentication/saml/logout?referer=ecash&authToken=XXX
2. The redirect URL passed to openAuthSessionAsync is CONST.SAML_REDIRECT_URL = 'expensify://open' — this is a native deep link scheme that does not work in a web browser
3. Since the redirect URL is invalid for web, the popup never auto-closes with a {type: 'success'} result. The user must manually close the popup, which resolves the promise with {type: 'dismiss'}
4. In callSAMLSignOut, the condition result && result.type !== 'success' evaluates to true for 'dismiss', causing the function to reject with "Logout cancelled" — the LOG_OUT API call is never made
5. However, the SAML Identity Provider may have already processed the logout within the popup, invalidating the user's SAML session on the backend
6. On the second sign-out attempt, callSAMLSignOut tries to use the now-invalidated auth token at the SAML logout endpoint, which returns a 500 error

In short: the SAML logout popup can't complete its redirect back to the app on web (because expensify://open is a mobile scheme), so the app thinks sign-out was cancelled, but the backend already processed it. This leaves the session in an inconsistent state.

Note: PR #83440 did not introduce this regression. All changes from that PR are gated behind CONFIG.IS_HYBRID_APP, which is false on standalone web. The callSAMLSignOut popup flow and the expensify://open redirect URL predate that PR. This bug was discovered during regression testing of PR #83440 but is a pre-existing issue with SAML sign-out on web.

What changes do you think we should make in order to solve the problem?

In callSAMLSignOut at src/libs/actions/Session/index.ts:260-266, on the web platform, when the popup result is 'dismiss' (user manually closed the popup), the function should still proceed with calling the LOG_OUT API instead of rejecting the promise. The SAML logout likely already completed in the popup, so the app-side sign-out should continue.

The check at line 261 should account for the web platform where 'dismiss' is the expected result (since the expensify://open redirect can never succeed in a browser). One approach:

• On web (non-hybrid), treat both 'success' and 'dismiss' results as successful and proceed to call LOG_OUT
• On native/hybrid, keep the existing behavior where 'dismiss' means the user cancelled

A longer-term fix would be to provide a web-appropriate SAML_REDIRECT_URL (a proper HTTPS URL) so that openAuthSessionAsync can resolve with {type: 'success'} on web, but the above change addresses the immediate sign-out failure.

What alternative solutions did you explore? (Optional)

1. Change SAML_REDIRECT_URL to a web URL — Would allow the popup to auto-close with {type: 'success'}, but requires backend changes to the SAML logout endpoint to redirect to a web URL instead of the deep link. More invasive change.
2. Skip the SAML popup entirely on web — Directly call the LOG_OUT API without the SAML popup. This would skip the SAML IdP logout but would at least allow the user to sign out of the app. However, it wouldn't properly terminate the SSO session with the IdP.

---

Next Steps for Contributor+ team: Reply with @MelvinBot implement this to create a draft PR, @MelvinBot <your feedback> to refine this analysis, or explain why you are rejecting Melvin's proposal.