# Logout using embedded sign-in widget fails

**URL:** <https://devforum.okta.com/t/logout-using-embedded-sign-in-widget-fails/20639>\
**Category:** OAuth/OIDC\
**Created:** [May 15, 2022, 2:02pm UTC](https://devforum.okta.com/t/logout-using-embedded-sign-in-widget-fails/20639 "2022-05-15T14:02:20Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![adrianopinaffo](https://avatars.discourse-cdn.com/v4/letter/a/0ea827/32.png) [@adrianopinaffo](https://devforum.okta.com/u/adrianopinaffo)\
**Post date:** [May 15, 2022, 2:02pm UTC](https://devforum.okta.com/t/logout-using-embedded-sign-in-widget-fails/20639/1 "2022-05-15T14:02:20Z")

</div>

I used the example in the oficial [Embedded Okta Sign-In Widget fundamentals](https://developer.okta.com/docs/guides/embedded-siw/main/) which is a simple webpage with log-in through JS in an HTML page, where the application on OKTA is configured as SPA.

The log-in works just fine, but when I try to logout, the page reloads and then it doesn’t show the log-in widget again. It shows I’m still logged in (apparently it never logged out). From what I can see, the `oktaSignIn.authClient.signOut()` method is failing on my case. Basically my original logout function is below:

```auto
function logout() {
    oktaSignIn.authClient.signOut();
    location.reload();
}

```

After looking for the answer in my places and checking some other answers in the forum and reading more about the [Okta Auth JavaScript SDK](https://github.com/okta/okta-auth-js), I came up with the following logout function that is working (apparently) like a charm:

```auto
async function logout() {
  // signOut() by itself is not working
  // After the location.reload() the screen doesn't load the sign-in widget,
  // and it shows it is still logged in
  // await oktaSignIn.authClient.signOut();

  // gets accessToken object to revoke it
  // recommended by https://github.com/okta/okta-auth-js#closesession
  const accessToken = await oktaSignIn.authClient.tokenManager.get('accessToken');

  // revokes access token
  await oktaSignIn.authClient.token.revoke(accessToken);

  // closes session, alternative to signOut()
  await oktaSignIn.authClient.session.close();

  // clears okta-token-storage from localStorage. Although documentation for
  // closeSession() says tokens are cleared in TokenManager, the actual browser
  // localstorage maintains the idToken. This clear() removes it
  await oktaSignIn.authClient.tokenManager.clear();

  // Reloads browser to show sign-in widget again
  location.reload();
}

```

So, my questions are:

- Why the official example is not working on my case? Am I forgetting something?
- I’m not sure the solution I came up with is the most efficient one, does anyone suggest that I change anything on it?
- Why don’t I see other people going through the same logout problems? Would it be because many people implement Okta Log-in for other platforms, like mobiles, back-end apps, machine-to-machine, etc?

Thank you,

---

<div class="post-metadata">

**Author:** ![erik](https://avatars.discourse-cdn.com/v4/letter/e/b5ac83/32.png) [@erik](https://devforum.okta.com/u/erik)\
**Post date:** [May 16, 2022, 5:38am UTC](https://devforum.okta.com/t/logout-using-embedded-sign-in-widget-fails/20639/2 "2022-05-16T05:38:20Z")

</div>

Hello,  
Sounds like you have a working solution. You could also do something like,

```auto
        oktaSignIn.authClient.signOut({
          clearTokensBeforeRedirect: true,
          postLogoutRedirectUri: 'http://localhost:8080/widget-appembed-A.html'
        });

```

---

<div class="post-metadata">

**Author:** ![adrianopinaffo](https://avatars.discourse-cdn.com/v4/letter/a/0ea827/32.png) [@adrianopinaffo](https://devforum.okta.com/u/adrianopinaffo)\
**Post date:** [May 27, 2022, 1:21pm UTC](https://devforum.okta.com/t/logout-using-embedded-sign-in-widget-fails/20639/3 "2022-05-27T13:21:15Z")

</div>

It took me a while to test this, but I finally did and it is not working…  
The same behavior is happening… I see the `okta-token-storage` key in my localStorage is removed and the page reloads, after that it automatically logs back in and the `okta-token-storage` is back in localStorage.

There is a note for `clearTokensBeforeRedirect`:

> **Use this option with care** : removing local tokens before fully terminating the Okta SSO session can result in logging back in again when using [`@okta/okta-react`](https://www.npmjs.com/package/@okta/okta-react)'s [`SecureRoute`](https://github.com/okta/okta-react#secureroute) component.

I’m not using react and I haven’t set `onAuthRequired` anywhere so I don’t know if it is applicable, but in any case, it is just not logging out with `.signout()`, only with `.session.close()`.

---

<div class="post-metadata">

**Author:** ![JoHe](https://avatars.discourse-cdn.com/v4/letter/j/e9c0ed/32.png) [@JoHe](https://devforum.okta.com/u/JoHe)\
**Post date:** [July 14, 2022, 3:00am UTC](https://devforum.okta.com/t/logout-using-embedded-sign-in-widget-fails/20639/4 "2022-07-14T03:00:15Z")

</div>

Thanks for the solution, I just stumbled over the same issue.

---

<div class="post-metadata">

**Author:** ![andrea](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/andrea/32/2172_2.png) [@andrea](https://devforum.okta.com/u/andrea)\
**Post date:** [February 12, 2024, 9:19pm UTC](https://devforum.okta.com/t/logout-using-embedded-sign-in-widget-fails/20639/5 "2024-02-12T21:19:10Z")

</div>