External issue Slow logout on Chrome on XF.com

[Chris D]

I have experienced the same behaviour you describe as being worse with passkey login when not logging in with a passkey.

There’s no difference between these paths, no material difference in the kind of data that should be deleted in either of these paths on logout.

The ultimate issue is how browsers respond to the request to clear site data. Whatever storage mechanism the browsers use to determine which data to remove is fundamentally flawed and poorly optimised.

I can see us probably having to flip the config switch so that the default becomes the original behaviour and you have to opt in to the more secure behaviour. Or, even simpler, just opt out now with the config switch we’ve provided.

 

[Weppa333]

Thanks for your reply ! And for the great support .

 

[cdub]

but I think it might actually be related to CloudFlare

Happens on my site and I'm not using CloudFlare. I must say it appears to be Chrome related though as I didn't notice same behavior in Firefox.

 

[vbresults]

@Chris D @Jeremy P What about attaching a _xfClearSiteData=1 value to the redirect URI (or new guest session if invoked through the login plugin outside of the regular logout flow), and then sending Clear-Site-Data in a fetch with {credentials: 'include'}?

In this scenario, browsers that behave properly could retain the existing synchronous behavior and those which do not would use this alternative. It introduces a minor race condition but that is superior to turning it off completely.