Team, why there is a force log out every time...

[Sunny2]

Team, why there is a force log out every time appsheet is closed?

It defeats the purpose of being an APP itself once login taking multiple steps to access. Thanks.

[Aleksi_Alkio]

Is it possible that your iPhone memory is almost full? You coud try to free some memory and see if that helps.

[Simon_Robinson]

If you close Appsheet it always makes you log back in, even on Android and Browser.

But, like @Aleksi_Alkio said, if it’s logging you out without you closing it.

Then this is your iPhone clearing the Appsheet cache.

Which you can do nothing about other than to make sure you have AT LEAST 15%-20% free space at all times.

[pravse]

Btw, in a browser and on a phone, AppSheet should not ask you to log back in everytime you restart it. Definitely not in a browser. So @Simon_Robinson if you are seeing this, you should figure out why this is — it may be you are running in incognito mode or something like that

[Sentra_Ventures]

I’m trying to achieve this very thing… i.e. force login after a set time or daily… our field users are sharing devices which raises huge security and access control problems…
Thanks

[Sunny2]

Thanks @Aleksi_Alkio & @Simon_Robinson for the suggestions.

@praveen but I am being still logged out of the iOS app and I am being asked to reauthenticate my GOOGLE account everytime I open the app.

The screenshot above comes every time.

I even cleared 2GB of space from my phone, but not getting through.

Is it anything to do with the new Google’s security revisions & updates?

[Simon_Robinson]

@praveen sorry you are right.

If its working correctly on a smartphone you should remain logged in even if you close appsheet.

Though if you then cleared appsheet cache it would then require you to login. Which is what I meant to say.

@Sunny based on what I’ve seen, you need to have 20% ish free space.

As an experiment try clearing up that much and see if this stops the issue.

If this works you should see straight away.

[pravse]

@kamila fyi – this (ability to control login lifetime) feels like an admin/security feature that we’d perhaps want to include in our roadmap. Let’s discuss as a feature request.

[Ed_Cottrell]

Hi Praveen, is this still on the road map? Could you shed any light on this? Some kind of force log-out is critical in our multi-tenant app. We are using a Cognito auth pool, and even deleting the user from the pool doesn’t stop them accessing the app. At a minimum this should be possible - to recheck the auth pool each time the app is accessed?

thanks,
Ed

[Steve]

I am not aware of any current or planned means to force a user logout.

[Ed_Cottrell]

Hmm.. what do you think Steve? I feel it’s these more fundamental things that should be on the road map first don’t you?

[Steve]

I do not, no. I wouldn't call this "fundamental".

[Ed_Cottrell]

I guess for me it’s fundamental (Oxford Dictionary of English: forming a necessary base or core; of central importance) 😜 in that it doesn’t provide the level of security control that I need in my use cases.

Anyway, good to know/hear your thoughts on the topic - thanks!

[kamila_klimek]

Thanks for sharing this gap Sentra Ventures, we’ll discuss it further - it sure seems like an important functionality for scenarios where devices are shared.

[EdCottrell]

I’m confused by this forum now - how is it that Kamila’s reply is showing at the bottom of the thread (now second to bottom) but with a date of July 2020?!  Which is clearly before more recent posts of June 2022… ANYWAY… side point!

More relevant, @kamila_klimek can you say if anything/what might/could happen / is happening with this? I’m intrigued as to how and which issues get escalated and which do not from this community – especially given the particular audience this thread has had 😜

As mentioned above, even deleting a user from a Cognito auth pool doesn’t prevent that user from accessing the app subsequently, as the auth cookie is still in place on the device or in their browser…. To expand on this further I would therefore also suspect (but I haven’t tested this) that even deleting a user’s email account, or suspending it, etc (say a work gmail account when they leave a company) would not prevent them from accessing the app afterwards - for as long as the cookie is there and they don’t log out.

Can this by any chance be escalated as it really is a crucial security issue.  What we need is to be able to set the duration that auth tokens last before requiring a refresh token or a new auth.  If this was a setting that can be controlled by devs then those users that want a basic app to always behave like an ‘app’ always on, always available etc could set this expiry time to ‘never’ (unless manually logged out), and others (like me in our multi-tenant app for business) could set the expiry to something reasonable like 30mins, or even more useful would be to set it as a long time like 1 month but then have the ability to void a token or force such log out – even better again if we can do this by calling the AppSheet API with a webhook to expire the token so that we can in fact control access using the app itself.  (This is typical in business apps I feel where admin users can control access by their teams/employees etc).

Sorry, got long!  Please help! 🙂