Fix SLO on web by jnowakow · Pull Request #86416 · Expensify/App

jnowakow · 2026-03-26T10:40:23Z

Explanation of Change

During work on #76246 one thing was missed. expo-web-browser works differently on mobile platforms and on web. On web it needs maybeCompleteAuthSession to be called from pop-up to determine that single logout request has finished and it can be closed.

Fixed Issues

$ #85937
PROPOSAL: N/A

Tests

Sign in via SSO
Click Account > Sign out
Verify that user is signed out successfully

Verify that no errors appear in the JS console

Offline tests

N/A

QA Steps

// TODO: These must be filled out, or the issue title must include "[No QA]."

Sign in via SSO (you can use applausetester+saml1@applause.expensifail.com)
Click Account > Sign out
Verify that user is signed out successfully

Verify that no errors appear in the JS console

PR Author Checklist

Screenshots/Videos

Android: Native

Android: mWeb Chrome

iOS: Native

iOS: mWeb Safari

MacOS: Chrome / Safari

SLO.mov

…-logout

melvin-bot · 2026-03-27T12:25:01Z

@huult Please copy/paste the Reviewer Checklist from here into a new comment on this PR and complete it. If you have the K2 extension, you can simply click: [this button]

jnowakow · 2026-03-27T12:26:44Z

@AndrewGable, I'm not sure if C+ can test this PR

huult · 2026-03-28T02:18:10Z

Ping me if we need a C+ review.

AndrewGable · 2026-04-03T21:09:04Z

Do we need to wait for https://github.com/Expensify/Web-Expensify/pull/51650 to hit production?

jnowakow · 2026-04-07T06:34:49Z

We can test on staging but I remember there were differences between staging and prod

jnowakow · 2026-04-08T06:24:23Z

@AndrewGable, https://github.com/Expensify/Web-Expensify/pull/51650 is on production

AndrewGable · 2026-04-09T21:29:59Z

@huult can you please C+ review this? Thank you!

huult · 2026-04-09T22:58:34Z

Yes

huult · 2026-04-12T16:06:49Z

Reviewer Checklist

I have verified the author checklist is complete (all boxes are checked off).
I verified the correct issue is linked in the ### Fixed Issues section above
I verified testing steps are clear and they cover the changes made in this PR
- I verified the steps for local testing are in the Tests section
- I verified the steps for Staging and/or Production testing are in the QA steps section
- I verified the steps cover any possible failure scenarios (i.e. verify an input displays the correct error message if the entered data is not correct)
- I turned off my network connection and tested it while offline to ensure it matches the expected behavior (i.e. verify the default avatar icon is displayed if app is offline)
I checked that screenshots or videos are included for tests on all platforms
I included screenshots or videos for tests on all platforms
I verified that the composer does not automatically focus or open the keyboard on mobile unless explicitly intended. This includes checking that returning the app from the background does not unexpectedly open the keyboard.
I verified tests pass on all platforms & I tested again on:
- Android: HybridApp
- Android: mWeb Chrome
- iOS: HybridApp
- iOS: mWeb Safari
- MacOS: Chrome / Safari
If there are any errors in the console that are unrelated to this PR, I either fixed them (preferred) or linked to where I reported them in Slack
I verified proper code patterns were followed (see Reviewing the code)
- I verified that any callback methods that were added or modified are named for what the method does and never what callback they handle (i.e. toggleReport and not onIconClick).
- I verified that comments were added to code that is not self explanatory
- I verified that any new or modified comments were clear, correct English, and explained "why" the code was doing something instead of only explaining "what" the code was doing.
- I verified any copy / text shown in the product is localized by adding it to src/languages/* files and using the translation method
- I verified all numbers, amounts, dates and phone numbers shown in the product are using the localization methods
- I verified any copy / text that was added to the app is grammatically correct in English. It adheres to proper capitalization guidelines (note: only the first word of header/labels should be capitalized), and is either coming verbatim from figma or has been approved by marketing (in order to get marketing approval, ask the Bug Zero team member to add the Waiting for copy label to the issue)
- I verified proper file naming conventions were followed for any new files or renamed files. All non-platform specific files are named after what they export and are not named "index.js". All platform-specific files are named for the platform the code supports as outlined in the README.
- I verified the JSDocs style guidelines (in STYLE.md) were followed
If a new code pattern is added I verified it was agreed to be used by multiple Expensify engineers
I verified that this PR follows the guidelines as stated in the Review Guidelines
I verified other components that can be impacted by these changes have been tested, and I retested again (i.e. if the PR modifies a shared library or component like Avatar, I verified the components using Avatar have been tested & I retested again)
I verified all code is DRY (the PR doesn't include any logic written more than once, with the exception of tests)
I verified any variables that can be defined as constants (ie. in CONST.ts or at the top of the file that uses the constant) are defined as such
If a new component is created I verified that:
- A similar component doesn't exist in the codebase
- All props are defined accurately and each prop has a /** comment above it */
- The file is named correctly
- The component has a clear name that is non-ambiguous and the purpose of the component can be inferred from the name alone
- The only data being stored in the state is data necessary for rendering and nothing else
- For Class Components, any internal methods passed to components event handlers are bound to this properly so there are no scoping issues (i.e. for onClick={this.submit} the method this.submit should be bound to this in the constructor)
- Any internal methods bound to this are necessary to be bound (i.e. avoid this.submit = this.submit.bind(this); if this.submit is never passed to a component event handler like onClick)
- All JSX used for rendering exists in the render method
- The component has the minimum amount of code necessary for its purpose, and it is broken down into smaller components in order to separate concerns and functions
If any new file was added I verified that:
- The file has a description of what it does and/or why is needed at the top of the file if the code is not self explanatory
If a new CSS style is added I verified that:
- A similar style doesn't already exist
- The style can't be created with an existing StyleUtils function (i.e. StyleUtils.getBackgroundAndBorderStyle(theme.componentBG)
If the PR modifies code that runs when editing or sending messages, I tested and verified there is no unexpected behavior for all supported markdown - URLs, single line code, code blocks, quotes, headings, bold, strikethrough, and italic.
If the PR modifies a generic component, I tested and verified that those changes do not break usages of that component in the rest of the App (i.e. if a shared library or component like Avatar is modified, I verified that Avatar is working as expected in all cases)
If the PR modifies a component related to any of the existing Storybook stories, I tested and verified all stories for that component are still working as expected.
If the PR modifies a component or page that can be accessed by a direct deeplink, I verified that the code functions as expected when the deeplink is used - from a logged in and logged out account.
If the PR modifies the UI (e.g. new buttons, new UI components, changing the padding/spacing/sizing, moving components, etc) or modifies the form input styles:
- I verified that all the inputs inside a form are aligned with each other.
- I added Design label and/or tagged @Expensify/design so the design team can review the changes.
If a new page is added, I verified it's using the ScrollView component to make it scrollable when more elements are added to the page.
For any bug fix or new feature in this PR, I verified that sufficient unit tests are included to prevent regressions in this flow.
If the main branch was merged into this PR after a review, I tested again and verified the outcome was still expected according to the Test steps.
I have checked off every checkbox in the PR reviewer checklist, including those that don't apply to this PR.

Screenshots/Videos

Android: HybridApp

Android: mWeb Chrome

iOS: HybridApp

iOS: mWeb Safari

MacOS: Chrome / Safari

huult · 2026-04-13T03:06:25Z

Screen.Recording.2026-04-13.at.10.02.02.mp4

@AndrewGable I can’t start the portal on local dev. Could you trigger an ad-hoc build?

github-actions · 2026-04-13T07:43:30Z

🚧 @mjasikowski has triggered a test Expensify/App build. You can view the workflow run here.

jnowakow · 2026-04-13T08:02:17Z

@huult, have you set up a domain on Expensify and IdP provider on your own? I think it's necessary to test this because you have to configure your IdP to redirect to adhoc address

huult · 2026-04-13T10:38:20Z

@jnowakow I’ll check and reconfigure it soon

jnowakow · 2026-04-14T08:38:48Z

Hmm I think you won't be able to get around callback mismatch error :/ Now I remember that it's hardcoded on backend and in order to for it to work I had to modify one variable in the code.
cc @AndrewGable

AndrewGable · 2026-04-14T18:22:04Z

I'm not sure you'll be able to configure this for testing, I'd just review it for code quality

huult · 2026-04-15T03:32:49Z

 function callSAMLSignOut(params: LogOutParams, authToken: string): Promise<void | Response<never>> {
    const queryString = CONFIG.IS_HYBRID_APP ? `appversion=${pkg.version}&referer=ecash&authToken=${authToken}` : `referer=ecash&authToken=${authToken}`;
-    return openAuthSessionAsync(`${CONFIG.EXPENSIFY.SAML_URL}/logout?${queryString}`, CONST.SAML_REDIRECT_URL)
+    const expectedURL = CONFIG.IS_HYBRID_APP ? CONST.SAML_REDIRECT_URL : CONFIG.EXPENSIFY.NEW_EXPENSIFY_URL;


Suggested change

const expectedURL = CONFIG.IS_HYBRID_APP ? CONST.SAML_REDIRECT_URL : CONFIG.EXPENSIFY.NEW_EXPENSIFY_URL;

const expectedURL = Platform.OS !== 'web' ? CONST.SAML_REDIRECT_URL : CONFIG.EXPENSIFY.NEW_EXPENSIFY_URL;

@jnowakow Could you help clarify why only hybrid apps use the SAML_REDIRECT_URL, while NewDot apps use the NEW_EXPENSIFY_URL?
My understanding is that web environments should use NEW_EXPENSIFY_URL, while native mobile environments should rely on SAML_REDIRECT_URL. Is that correct?

Exactly! Web expects url staring with https:// while mobile apps expect deep link starting with expenify://

@jnowakow Nice, let's check my suggested change. We can't use IS_HYBRID_APP to detect web vs mobile app, since IS_HYBRID_APP is specifically used to detect hybrid apps.

Right, it make sense!

@huult I've applied you suggestion but without negation - I think it's simpler to understand it this way

@jnowakow Your changes look good. Could you add test cases to cover the new updates? I think it would be useful and shouldn’t take much time. After you add them, I will approve this PR.

@huult I've updated tests. Please take a look

…-logout

huult · 2026-04-15T14:58:53Z

+    const queryString = Platform.OS === 'web' ? `referer=ecash&authToken=${authToken}` : `appversion=${pkg.version}&referer=ecash&authToken=${authToken}`;
+    const expectedURL = Platform.OS === 'web' ? CONFIG.EXPENSIFY.NEW_EXPENSIFY_URL : CONST.SAML_REDIRECT_URL;


Suggested change

const queryString = Platform.OS === 'web' ? `referer=ecash&authToken=${authToken}` : `appversion=${pkg.version}&referer=ecash&authToken=${authToken}`;

const expectedURL = Platform.OS === 'web' ? CONFIG.EXPENSIFY.NEW_EXPENSIFY_URL : CONST.SAML_REDIRECT_URL;

const isWeb = getPlatform() === CONST.PLATFORM.WEB;

const queryString = isWeb ? `referer=ecash&authToken=${authToken}` : `appversion=${pkg.version}&referer=ecash&authToken=${authToken}`;

const expectedURL = isWeb ? CONFIG.EXPENSIFY.NEW_EXPENSIFY_URL : CONST.SAML_REDIRECT_URL;

Please create an isWeb constant to avoid duplication.

There's difference between mobileweb and web so it won't work. I'll go with isWeb = Platform.OS === 'web'

@jnowakow Could you create

const isWeb = getPlatform() === CONST.PLATFORM.WEB;

outside the callSAMLSignOut function and use isWeb for the checks to avoid duplication?

There's difference between mobileweb and web so it won't work. I'll go with isWeb = Platform.OS === 'web'

@jnowakow Could you check the getPlatform function? I noticed that in the current codebase, we don’t use Platform.OS === 'web' directly in components and pages because getPlatform already supports all the cases you need.

huult · 2026-04-15T15:06:07Z

+            mockedOpenAuthSessionAsync.mockClear();
+
+            const originalPlatformOS = Platform.OS;
+            Platform.OS = 'web';


Could you check how we mocked getPlatform previously and follow the same approach? For example:
https://github.com/Expensify/App/blob/fce5a62db323b89c987c072de195f390bef23b85/tests/unit/pages/workspace/accounting/qbd/utilsTest.ts

jnowakow · 2026-04-17T11:01:07Z

@huult I've applied your suggestions :)

huult

LGTM!

jnowakow · 2026-04-21T07:34:50Z

@AndrewGable, C+ approved the PR, please take a look when you have a moment

OSBotify · 2026-04-21T17:10:15Z

✋ This PR was not deployed to staging yet because QA is ongoing. It will be automatically deployed to staging after the next production release.

github-actions · 2026-04-21T17:35:16Z

🚧 @AndrewGable has triggered a test Expensify/App build. You can view the workflow run here.

github-actions · 2026-04-21T17:50:45Z

🧪🧪 Use the links below to test this adhoc build on Android, iOS, and Web. Happy testing! 🧪🧪
Built from App PR #86416.

Android 🤖	iOS 🍎
https://ad-hoc-expensify-cash.s3.us-east-1.amazonaws.com/rock-artifacts/ad-hoc/rock-android-Adhoc-421e06c-ec04572-4cfa62ac19ff33d298f504581f255562207611dd/index.html	https://ad-hoc-expensify-cash.s3.us-east-1.amazonaws.com/rock-artifacts/ad-hoc/rock-ios-device-AdHoc-421e06c-ec04572-82a3ff3b8a98233ae723a8d03002e33d5dbd8abd/index.html

Web 🕸️
https://86416.pr-testing.expensify.com

👀 View the workflow run that generated this build 👀

OSBotify · 2026-04-23T20:17:16Z

🚀 Deployed to staging by https://github.com/AndrewGable in version: 9.3.62-0 🚀

platform	result
🕸 web 🕸	success ✅
🤖 android 🤖	success ✅
🍎 iOS 🍎	success ✅

Bundle Size Analysis (Sentry):

Android
iOS

OSBotify · 2026-04-28T01:35:45Z

🚀 Deployed to staging by https://github.com/AndrewGable in version: 9.3.64-0 🚀

platform	result
🕸 web 🕸	success ✅
🤖 android 🤖	success ✅
🍎 iOS 🍎	success ✅

Bundle Size Analysis (Sentry):

Android
iOS

MelvinBot · 2026-04-28T01:37:12Z

No help site changes required.

This PR fixes an internal implementation detail of SSO Single Logout (SLO) on web — specifically, it adds maybeCompleteAuthSession() to handle browser pop-up closure during logout, and adjusts the SAML sign-out redirect URL and query parameters for the web platform.

The relevant help site articles (Set-Up-SAML-SSO.md and Troubleshoot-SAML-SSO-Login.md) cover SAML setup, configuration, and login troubleshooting. They don't document the sign-out flow itself. Since the user-visible sign-out behavior and steps remain unchanged, no documentation updates are needed.

arosiclair · 2026-04-29T21:08:59Z

@AndrewGable @jnowakow based on this comment it seems like this did not pass QA. This is NAB so I'll check it off.

OSBotify · 2026-04-30T22:43:18Z

🚀 Deployed to production by https://github.com/arosiclair in version: 9.3.64-31 🚀

platform	result
🕸 web 🕸	success ✅
🤖 android 🤖	success ✅
🍎 iOS 🍎	success ✅

Fix SLO on web

56ca7b3

melvin-bot Bot assigned jnowakow Mar 26, 2026

jnowakow requested a review from AndrewGable March 26, 2026 10:42

jnowakow added 2 commits March 26, 2026 12:06

Update test

ef186a8

Merge branch 'main' of github.com:Expensify/App into jnowakow/fix-slo…

4317b45

…-logout

jnowakow changed the title ~~Fix SLO on web~~ [Hold for https://github.com/Expensify/Web-Expensify/pull/51650] Fix SLO on web Mar 26, 2026

jnowakow marked this pull request as ready for review March 27, 2026 12:24

jnowakow requested review from a team as code owners March 27, 2026 12:24

melvin-bot Bot requested review from heyjennahay and huult and removed request for a team March 27, 2026 12:24

melvin-bot Bot removed the request for review from a team March 27, 2026 12:25

jnowakow marked this pull request as draft March 27, 2026 12:28

jnowakow marked this pull request as ready for review April 3, 2026 06:23

jnowakow changed the title ~~[Hold for https://github.com/Expensify/Web-Expensify/pull/51650] Fix SLO on web~~ Fix SLO on web Apr 7, 2026

This comment has been minimized.

Sign in to view

huult reviewed Apr 15, 2026

View reviewed changes

jnowakow added 4 commits April 15, 2026 10:39

use platfrom api instead IS_HYBRID_APP

d243f99

Merge branch 'main' of github.com:Expensify/App into jnowakow/fix-slo…

25d8191

…-logout

fix test

998ad6d

test correct url both on web and mobile

15d8e32

huult reviewed Apr 15, 2026

View reviewed changes

move common logic to variable

68d7700

huult reviewed Apr 15, 2026

View reviewed changes

huult mentioned this pull request Apr 17, 2026

[Payment due @huult] [Internal QA] Trigger SAML sign-in when trying to re-auth a SAML required account #87368

Merged

52 tasks

getPlatform instead Platform.OS

b475619

huult approved these changes Apr 19, 2026

View reviewed changes

Merge branch 'main' into jnowakow/fix-slo-logout

1a250d6

AndrewGable approved these changes Apr 21, 2026

View reviewed changes

AndrewGable merged commit 421e06c into Expensify:main Apr 21, 2026
32 checks passed

OSBotify mentioned this pull request Apr 23, 2026

Deploy Checklist: New Expensify 2026-04-23 #88633

Closed

OSBotify mentioned this pull request Apr 27, 2026

[Due for payment 2026-05-07] [$250] Create Account - Unable to logged in with account if navigated to the app via Magic link #88987

Open

7 tasks

arosiclair mentioned this pull request Apr 29, 2026

PR checklist #89226

Open

melvin-bot Bot mentioned this pull request Apr 30, 2026

[Due for payment 2026-05-07] Web - SSO - Unable to sign out #85937

Closed

7 tasks

	const expectedURL = CONFIG.IS_HYBRID_APP ? CONST.SAML_REDIRECT_URL : CONFIG.EXPENSIFY.NEW_EXPENSIFY_URL;
	const expectedURL = Platform.OS !== 'web' ? CONST.SAML_REDIRECT_URL : CONFIG.EXPENSIFY.NEW_EXPENSIFY_URL;

		const queryString = Platform.OS === 'web' ? `referer=ecash&authToken=${authToken}` : `appversion=${pkg.version}&referer=ecash&authToken=${authToken}`;
		const expectedURL = Platform.OS === 'web' ? CONFIG.EXPENSIFY.NEW_EXPENSIFY_URL : CONST.SAML_REDIRECT_URL;

-    const queryString = Platform.OS === 'web' ? `referer=ecash&authToken=${authToken}` : `appversion=${pkg.version}&referer=ecash&authToken=${authToken}`;
-    const expectedURL = Platform.OS === 'web' ? CONFIG.EXPENSIFY.NEW_EXPENSIFY_URL : CONST.SAML_REDIRECT_URL;
+    const isWeb = getPlatform() === CONST.PLATFORM.WEB;
+    const queryString = isWeb ? `referer=ecash&authToken=${authToken}` : `appversion=${pkg.version}&referer=ecash&authToken=${authToken}`;
+    const expectedURL = isWeb ? CONFIG.EXPENSIFY.NEW_EXPENSIFY_URL : CONST.SAML_REDIRECT_URL;

Conversation

jnowakow commented Mar 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Explanation of Change

Fixed Issues

Tests

Offline tests

QA Steps

PR Author Checklist

Screenshots/Videos

Uh oh!

melvin-bot Bot commented Mar 27, 2026

Uh oh!

jnowakow commented Mar 27, 2026

Uh oh!

huult commented Mar 28, 2026

Uh oh!

AndrewGable commented Apr 3, 2026

Uh oh!

jnowakow commented Apr 7, 2026

Uh oh!

jnowakow commented Apr 8, 2026

Uh oh!

AndrewGable commented Apr 9, 2026

Uh oh!

huult commented Apr 9, 2026

Uh oh!

huult commented Apr 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Reviewer Checklist

Screenshots/Videos

Uh oh!

huult commented Apr 13, 2026

Uh oh!

github-actions Bot commented Apr 13, 2026

Uh oh!

jnowakow commented Apr 13, 2026

Uh oh!

This comment has been minimized.

huult commented Apr 13, 2026

Uh oh!

jnowakow commented Apr 14, 2026

Uh oh!

AndrewGable commented Apr 14, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

huult Apr 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

jnowakow commented Apr 17, 2026

Uh oh!

huult left a comment

Choose a reason for hiding this comment

Uh oh!

jnowakow commented Apr 21, 2026

Uh oh!

Uh oh!

OSBotify commented Apr 21, 2026

jnowakow commented Mar 26, 2026 •

edited

Loading

huult commented Apr 12, 2026 •

edited

Loading

huult Apr 15, 2026 •

edited

Loading