logOut() triggers session_changed which refreshes token

[johighley]

logOut(true) removes items from session storage. When item 'session_state' is removed, it causes a 'session_changed' event. The event handler, handleSessionChange() then retrieves a new token using either refreshToken() or silentRefresh() even though the intent was to logout and clear local state.

The state change event should not trigger a new token when caused by logout.

Windows 10, Chrome

version 18.0.0

[johighley-ssnc]

Logout() removes session_state from session storage: https://github.com/manfredsteyer/angular-oauth2-oidc/blob/18.0.0/projects/lib/src/oauth-service.ts#L2516

That triggers the sessionCheckEventListener: https://github.com/manfredsteyer/angular-oauth2-oidc/blob/18.0.0/projects/lib/src/oauth-service.ts#L1307

The event listener calls handleSessionChange() which will call refresh token or perform a silent refresh: https://github.com/manfredsteyer/angular-oauth2-oidc/blob/18.0.0/projects/lib/src/oauth-service.ts#L1307