Logging out of mobile app without Internet connection

Question

I’m currently developing an Android app (native) that connects to a service via an API. I recently added a logout functionality that

1. sends a call via the API to logout the user on the server
2. destroys all session keys and tokens
3. leads the user back to the login activity

But what happens if there’s no active Internet connection or timeouts occur, i.e., the first point on the list cannot be executed?

What I’m currently doing: Execute 2 and 3 anyway, regardless of the outcome of the logout API call. I don’t even bother yet to show the user a message that something failed.

However, I’m not too happy with that. Security-wise, I’m not sure what implications that behaviour would have, but this StackExchange is not the right place to ask that.

So to me it seems like I’m left with the following choices:

• Don’t care for the response, delete keys, then change activity
• Care for response, delete keys and change activity only onSuccess
• Care for response, delete keys and change activity regardless but notify user

Which way would be preferable? Ideally also taking security aspects into consideration, but that’s not a necessity.

Answer 1

Care for response, delete keys and change activity regardless but notify user

Have a serverside backup system. Every so often (once a minute, once every 10 minutes, you decide) you ping the device from the server. If the ping comes back, session stays open. If it doesn't, session ends.

Then, when you logout but can't connect to your server, you give them a popup:

We couldn't connect to the server. You can wait a few minutes and our server will automatically log you out, or you can try to get an internet connection and manually log out.

or something along those lines.

You could re-use the same popup/interstitial format for other related information;

You have successfully logged out.

or

We can't connect to the server. For security reasons, our servers will automatically log you out in a few minutes.

Answer 2

You could pass a "logout" token to the client when they first login that gets stored. Then instead of deleting the session token, you replace them with the logout token. That way, the next time you connect, the cookie is received by the server and automatically logs out the session if it still exists.

The client knows it's logged out. The server knows as soon as the next connection is made.

You tell the user.

You have successfully logged out. The server will be notified the next time you connect.