Web - SSO/SAML - User unable to sign out, a new windows always open

[lanitochka17]

If you haven’t already, check out our contributing guidelines for onboarding and email contributors@expensify.com to request to join our Slack channel!

---

Version Number: v9.3.69-3
Reproducible in staging?: Yes
Reproducible in production?: N/A - new feature, doesn't exist in prod
If this was caught during regression testing, add the test name, ID and link from BrowserStack: #89894
Email or phone of affected tester (no customers): applausetester+saml1@applause.expensifail.com
Issue reported by: Applause Internal Team
Bug source: Pull Request QA execution
Device used: Windows 11 / Chrome
App Component: Other

Action Performed:

Precondition:

• SAML requirement for login is enabled

1. Open https://staging.new.expensify.com/
2. Sign in via SSO (you can use applausetester+saml1@applause.expensifail.com)
3. Navigate to Account > click Sign out

Expected Result:

User should be able to sign out successfully

Actual Result:

When attempting to sign out after signing in via SSO, a new browser window opens and redirects to the Profile page. If you close this window and click 'Sign out' again, the SSO login page will appear again.

Workaround:

Unknown

Platforms:

• Android: App
• Android: mWeb Chrome
• iOS: App
• iOS: mWeb Safari
• iOS: mWeb Chrome
• Windows: Chrome
• MacOS: Chrome / Safari

Screenshots/Videos

Bug7148960_1778300374097.90006_-_PR89894_-_Web_-_SSOSAML_-_User_unable_to_sign_out__a_new_windows_always_open.mp4

View all open jobs on GitHub

[melvin-bot]

@AndrewGable recently merged #89894, but they are OOO right now, so I'll auto-assign someone else.

[melvin-bot]

Triggered auto assignment to @stitesExpensify (DeployBlockerCash), see https://stackoverflowteams.com/c/expensify/questions/9980/ for more details.

[melvin-bot]

💬 A slack conversation has been started in #expensify-open-source

[github-actions]

👋 Friendly reminder that deploy blockers are time-sensitive ⏱ issues! Check out the open `StagingDeployCash` deploy checklist to see the list of PRs included in this release, then work quickly to do one of the following:

1. Identify the pull request that introduced this issue and revert it.
2. Find someone who can quickly fix the issue.
3. Fix the issue yourself.

[OSBotify]

Investigation Summary

Classification: Frontend bug
Causing PR: #89894 - "Preserve information about saml session when logging out previous user" by @jnowakow (High confidence)
Related Issues: N/A

Recommendation: REVERT

PR #89894 introduced a regression in the SAML sign-out flow on web. The fix passes isSAML=true from URL params into the session state (signedInWithSAML: true), which causes the logout path to invoke the SAML single logout (SLO) flow via callSAMLSignOut. On web, that function calls openAuthSessionAsync, which opens a new browser popup — exactly the behavior described in the bug report. The change is small (4 lines), touches only one file, and has a clean revert target.

Assigned: @jnowakow (PR author), @AndrewGable (approving reviewer)
Labels: DeployBlockerCash kept (Frontend bug in App PR). No label changes made.

Detailed Analysis

Evidence

• The issue body explicitly links PR Preserve information about saml session when loging out previous user #89894 as the source: "If you haven't already, check out... Preserve information about saml session when loging out previous user #89894"
• The melvin-bot comment also directly attributes the issue to PR Preserve information about saml session when loging out previous user #89894: "@AndrewGable recently merged Preserve information about saml session when loging out previous user #89894"
• The bug manifests only on staging and is listed as a new feature not present in production, matching the staging-only merge of PR Preserve information about saml session when loging out previous user #89894 (merged 2026-05-07)
• The bug occurs on Windows/Chrome (web platform), which is exactly where the SAML web logout flow differs from native

Verification

• Affected file: src/pages/LogOutPreviousUserPage.tsx — this is the only file changed by PR Preserve information about saml session when loging out previous user #89894
• Mechanism: PR Preserve information about saml session when loging out previous user #89894 extracts isSAML from route params and passes it as the second argument to signInWithShortLivedAuthToken(shortLivedAuthToken, !!isSAML). This causes getShortLivedLoginParams to set signedInWithSAML: true in the Onyx SESSION store.
• Sign-out path: signOutAndRedirectToSignIn calls signOut({signedInWithSAML: !!session.signedInWithSAML, authToken: session.authToken}). With signedInWithSAML=true, the signOut function branches into callSAMLSignOut.
• Root cause behavior: callSAMLSignOut on web calls openAuthSessionAsync, which opens a browser popup directed at the SAML logout URL. The popup opens and redirects to the Profile page (as reported), rather than performing a clean in-app logout.

Root Cause

Before PR #89894, signInWithShortLivedAuthToken was always called without the isSAML flag (defaulting to false), so the session never had signedInWithSAML: true set via the LogOutPreviousUserPage path. After the PR, if a user signs in via SSO (SAML), the isSAML URL param is present, and the session is now marked with signedInWithSAML: true. When the user subsequently signs out via the normal UI path, the SAML single logout (SLO) flow is triggered — opening a new browser window — instead of the standard logout, causing the broken sign-out experience reported.