Question

I have a website that allows users to login w/ their google account, http://urlme.cc

Issue: user Bob logs in as [e-mail], then logs back out, and THEN decides that he wants login as [e-mail], one of his alternate gmail address, he can’t do that. If he leaves the “remember me” checkbox checked on google’s login page, it’ll remember him. Is this possible? I know the user can manually revoke the association on “https://www.google.com/accounts/IssuedAuthSubTokens“, but, there’s got to be an easier way where I as the developer can revoke it for him.

Please let me know if I need to word this better!

Answer 1

The “remember me” checkbox has only meaning when the user is logged in to google.

when he logs into another account, google will no longer authenticate the previous account, and instead use the one he is logged into.

In steps:

1. User logs in as [e-mail] to Google
2. User clicks “sign in with Google” at the site
3. Google asks the user for permission to authenticate, and asks whether to remember that permission (and not the user)
4. User is signed in, but decides that it was a bad idea to authenticate with this account
5. User logs out at the site and at Google
6. User logs in at Google as [e-mail]
7. User clicks “sign in with Google” at the site
8. Since now another user is signed in, and he didn’t permit to authenticate yet, Google asks for the permission, as in step 3.
9. User has allowed the auth, so now Google returns a different identifier, the one for [e-mail], and neither Google nor the site have any knowledge that the two accounts are connected in any way. The site sees two separate users, and so does Google.

Also, it doesn’t seem like a best idea to limit your users to one provider. OpenID is all about decentralization — you should at least allow to manually enter an identifier.

And again: “remember me” means: “Don’t ask me for the permission to send that data the next time.”, and not “Remember that the one using this machine is me”(that’s the “remember me” when you log in to Google).

And no, there is no way to either revoke the user’s permission automatically, or know that he has one remembered, and I don’t see any reason why you might want to.