Signout does not logout user when session is being requested simultaneously

Environment

 System:
    OS: macOS 12.3.1
    CPU: (16) x64 Intel(R) Core(TM) i9-9880H CPU @ 2.30GHz
    Memory: 1.18 GB / 32.00 GB
    Shell: 5.8 - /bin/zsh
 Binaries:
    Node: 14.17.0 - ~/.nvm/versions/node/v14.17.0/bin/node
    Yarn: 1.22.10 - /usr/local/bin/yarn
    npm: 8.5.5 - ~/.nvm/versions/node/v14.17.0/bin/npm
    Watchman: 2022.03.21.00 - /usr/local/bin/watchman
 Browsers:
    Chrome: 101.0.4951.64
    Edge: 101.0.1210.53
    Firefox: 100.0.2
    Safari: 15.4
  npmPackages:
    next: ^12.0.11-canary.4 => 12.1.6 
    next-auth: latest => 4.3.4 
    react: ^17.0.2 => 17.0.2 

Reproduction URL

https://next-auth-example.vercel.app

Describe the issue

Using signOut() with multiple tabs open I discovered that sometimes the user was not getting logged out. While the /session call initially returns an empty object subsequent calls would return the user’s session again failing to log out the user. This was happening because on logout my application would redirect to a specific logout page where we check if the user is authenticated by calling /session that was authenticating the user again. This is reproducible on the official example as well if we reload one of the tabs after calling sign out from the other.

How to reproduce

I reproduced the issue with the official next-auth-example project. Steps to reproduce:

• Open the example project in two different tabs.
• Log in to the app.
• Sign out of the app then immediately switch to the other tab and reload the page.

Current behavior:

The signout endpoint responds with a 200 status however the session is not cleared and the user is still logged in.

Video:

https://user-images.githubusercontent.com/17233313/169841068-70288c2a-746f-4479-83cd-8e5342315351.mov

Expected behavior

The user should be logged out or the /signout API should respond with an error code.

[crrmacarse]

Up with this.

This seems to only happen on our prod when multiple requests are firing at once. The signOut doesn’t work as intended and only refreshes the page(without logging out the user)

[crrmacarse]

Hi @ben-walcutt ,

Not related to the issue but there is a better approach on your problem by adding it on next-auth’s event(https://next-auth.js.org/configuration/events#signout)

// [...next-auth].ts
events: {
    async signOut() {
      // add here
    },
  },

It’ll be called after triggering signOut