I’m currently developing an Android app (native) that connects to a service via an API. I recently added a logout functionality that
- sends a call via the API to logout the user on the server
- destroys all session keys and tokens
- leads the user back to the login activity
But what happens if there’s no active Internet connection or timeouts occur, i.e., the first point on the list cannot be executed?
What I’m currently doing: Execute 2 and 3 anyway, regardless of the outcome of the logout API call. I don’t even bother yet to show the user a message that something failed.
However, I’m not too happy with that. Security-wise, I’m not sure what implications that behaviour would have, but this StackExchange is not the right place to ask that.
So to me it seems like I’m left with the following choices:
- Don’t care for the response, delete keys, then change activity
- Care for response, delete keys and change activity only onSuccess
- Care for response, delete keys and change activity regardless but notify user
Which way would be preferable? Ideally also taking security aspects into consideration, but that’s not a necessity.