plataformatec/devise — Issue #1368: Omniauth Strange case when re-authenticaticating the user
Author: khelll
Created: 2011-10-08 10:50:45+00:00
State: open

I'm developing a Facebook app, and I'm having the following scenario:

- User A is using the app and logged in.
- User A logs out of Facebook.
- User B logs in Facebook using the same machine/browser the user A was using.
- User B tries to use the app, but the current session is still for user A.
- The app detects this and tries to re-authenticate the User B by redirecting him to user_omniauth_authorize_path(:facebook).
- User B gets a new session but for the *User A!!!*

I have investigated this, and the request.env['omniauth.auth'] keeps showing the information of the user A. I have also cleared the user session before re-authenticating, and still the same case happens. What to do in this case, to make sure the user B is logged in via the proper session?