[Due for payment 2026-03-30] [$250] User is forwarded to onelogin on sign out without a cancel prompt

[lanitochka17]

If you haven’t already, check out our contributing guidelines for onboarding and email contributors@expensify.com to request to join our Slack channel!

---

Version Number: 9.3.23-2
Reproducible in staging?: Yes
Reproducible in production?: Yes
If this was caught during regression testing, add the test name, ID and link from BrowserStack: #82787
Email or phone of affected tester (no customers): applausetester+saml1@applause.expensifail.com
Issue reported by: Applause Internal Team
Bug source: Pull Request QA execution
Device used: Google Pixel 9 Pro, Android 16
App Component: User Settings

Action Performed:

1. Login to expensify with an SSO account (enable SAML from OD and use any of the saml accounts from 1 password applausetester+saml1@applause.expensifail.com)
2. Go to Account
3. Tap on Sign out
4. Cancel the webview

Expected Result:

User is not signed out. After tapping sign out a cancel or confirm pop up is shown according to PR

Actual Result:

User is automatically redirected to the onelogin sign in page. Going back to expensify without any action on the webview still signs out the user

Workaround:

Unknown

Platforms:

• Android: App
• Android: mWeb Chrome
• iOS: App
• iOS: mWeb Safari
• iOS: mWeb Chrome
• Windows: Chrome
• MacOS: Chrome / Safari

Screenshots/Videos

Bug7083556_1771597053528.az_recorder_20260220_025000.mp4

View all open jobs on GitHub

Issue Owner

Current Issue Owner: @jjcoffee

Upwork Automation - Do Not Edit

• Upwork Job URL: https://www.upwork.com/jobs/~022024856527900868590
• Upwork Job ID: 2024856527900868590
• Last Price Increase: 2026-02-20

[melvin-bot]

Triggered auto assignment to Contributor-plus team member for initial proposal review - @jjcoffee (External)

[melvin-bot]

Triggered auto assignment to @heyjennahay (Bug), see https://stackoverflow.com/c/expensify/questions/14418 for more details. Please add this bug to a GH project, as outlined in the SO.

[melvin-bot]

Job added to Upwork: https://www.upwork.com/jobs/~022024856527900868590

[MelvinBot]

Proposal

Please re-state the problem that we are trying to solve in this issue.

When a SAML/SSO user taps "Sign out" on Android, they are immediately redirected to the OneLogin sign-in page without seeing a cancel/confirm prompt. Even if the user navigates back without completing any action on the webview, they are still signed out. PR #82787 fixed this for iOS but the same problem persists on Android.

What is the root cause of that problem?

The SAML sign-out flow in callSAMLSignOut (src/libs/actions/Session/index.ts:260-274) opens the SAML logout URL via openAuthSessionAsync from expo-web-browser. This function behaves differently on iOS vs Android:

On iOS: openAuthSessionAsync uses the native ASWebAuthenticationSession, which shows a system-level consent dialog before loading the URL. If the user taps "Cancel", the URL is never loaded, the function returns { type: 'cancel' }, and callSAMLSignOut correctly rejects with 'Logout cancelled' — the user stays logged in.

On Android: openAuthSessionAsync falls back to a polyfill (expo-web-browser/src/WebBrowser.ts:384-420) that immediately opens a Chrome Custom Tab and navigates to the SAML logout URL. There is no confirmation prompt. The moment the URL loads, the SAML Identity Provider (OneLogin) processes the logout request server-side, invalidating the session. When the user presses back, the polyfill correctly returns { type: 'dismiss' } and the app skips the LOG_OUT API call — but the IdP session is already invalidated. Additionally, if the IdP auto-redirects to the expensify://open deep link after processing logout, the redirect listener wins the Promise.race with { type: 'success' }, causing the app to also call the LOG_OUT API, completing the sign-out on both sides.

The core issue is that on Android there is no way to present a cancellation prompt before the SAML logout URL is loaded in the browser.

What changes do you think we should make in order to solve the problem?

In callSAMLSignOut (or at the call site in signOutAndRedirectToSignIn), add a platform check for Android that shows an Alert.alert confirmation dialog before calling openAuthSessionAsync. If the user confirms, proceed with opening the SAML logout URL. If they cancel, reject the promise early without ever opening the browser.

This mirrors the native behavior that iOS gets for free via ASWebAuthenticationSession's built-in consent prompt, but implements it at the application level for Android where no such native prompt exists.

The change would be in src/libs/actions/Session/index.ts, in the callSAMLSignOut function, wrapping the openAuthSessionAsync call in a confirmation dialog on Android (using Platform.OS === 'android').

What alternative solutions did you explore? (Optional)

1. Using a custom WebView instead of Chrome Custom Tabs — This would give more control over the flow but would revert the improvement from PR Replace WebView in SAML sign in implementation #76246 which specifically moved away from WebView to expo-web-browser for security and reliability reasons.

2. Deferring the server-side logout — Instead of passing the authToken as a query parameter in the URL (which triggers immediate server-side logout on page load), the app could open a confirmation page first and only trigger the actual SAML logout after user confirmation. However, this would require server-side changes to the SAML logout endpoint.

---

Detailed Investigation

Root Cause Analysis

The sign-out flow for SAML users works as follows:

1. User taps "Sign out" → signOutAndRedirectToSignIn() is called (index.ts:325)
2. signOut() is called with signedInWithSAML=true (index.ts:347)
3. signOut() delegates to callSAMLSignOut() (index.ts:252-253)
4. callSAMLSignOut opens ${SAML_URL}/logout?authToken=<token> via openAuthSessionAsync with redirect URL expensify://open (index.ts:262)

The openAuthSessionAsync from expo-web-browser (v15.0.10) has platform-specific behavior:

• iOS/macOS: Uses native ExponentWebBrowser.openAuthSessionAsync → ASWebAuthenticationSession which shows a system consent dialog before loading the URL
• Android: Since _authSessionIsNativelySupported() returns false for Android (WebBrowser.ts:323-324), it uses _openAuthSessionPolyfillAsync which runs a Promise.race between _openBrowserAndWaitAndroidAsync (Chrome Custom Tab + AppState listener) and _waitForRedirectAsync (deep link listener)

On Android, Chrome Custom Tabs immediately loads the SAML logout URL. The SAML IdP processes the logout upon page load. Even if the user presses back:

• The app correctly detects { type: 'dismiss' } and rejects with 'Logout cancelled'
• The .catch in signOutAndRedirectToSignIn at line 454 just logs a warning
• But the SAML IdP session is already invalidated server-side

Evidence Chain

1. openAuthSessionAsync on Android immediately opens the URL (no native confirmation) → SAML IdP processes logout on page load → session invalidated server-side
2. User presses back → AppState becomes 'active' → polyfill returns { type: 'dismiss' } → callSAMLSignOut rejects → app doesn't call LOG_OUT API → but session is already dead
3. OR: SAML IdP auto-redirects to expensify://open → _waitForRedirectAsync resolves with { type: 'success' } → callSAMLSignOut calls LOG_OUT API → user is fully signed out

Relevant Code

• src/libs/actions/Session/index.ts:260-274 - callSAMLSignOut function
• src/libs/actions/Session/index.ts:325-455 - signOutAndRedirectToSignIn function
• expo-web-browser/src/WebBrowser.ts:234-250 - openAuthSessionAsync with platform branching
• expo-web-browser/src/WebBrowser.ts:354-420 - Android polyfill implementation

---

Confidence: High — the platform difference in expo-web-browser's openAuthSessionAsync (native ASWebAuthenticationSession on iOS vs Chrome Custom Tab polyfill on Android) directly explains why the iOS fix in PR #82787 doesn't apply to Android.

Next Steps for Contributor+ team: Reply with @MelvinBot implement this to create a draft PR, or @MelvinBot <your feedback> to refine this analysis.

[husamdaifalla01-cmyk]

🚫 Duplicated proposal withdrawn by 🤖 ProposalPolice.

[melvin-bot]

📣 @husamdaifalla01-cmyk! 📣
Hey, it seems we don’t have your contributor details yet! You'll only have to do this once, and this is how we'll hire you on Upwork.
Please follow these steps:

1. Make sure you've read and understood the contributing guidelines.
2. Get the email address used to login to your Expensify account. If you don't already have an Expensify account, create one here. If you have multiple accounts (e.g. one for testing), please use your main account email.
3. Get the link to your Upwork profile. It's necessary because we only pay via Upwork. You can access it by logging in, and then clicking on your name. It'll look like this. If you don't already have an account, sign up for one here.
4. Copy the format below and paste it in a comment on this issue. Replace the placeholder text with your actual details.
   
   Format:

Contributor details
Your Expensify account email: <REPLACE EMAIL HERE>
Upwork Profile Link: <REPLACE LINK HERE>