Keep open tabs in step when you sign out
Signing out should not leave another tab looking active. Wildo tells the application’s other same-origin tabs to clear their authentication state, API credentials and live connection.
This keeps the browser experience consistent while the backend handles token revocation.
Example — Leave the account in every open tab
A person signs out in one tab. Their other application tab clears its signed-in state too, rather than continuing to display working account controls.
For engineers
The standard authentication provider coordinates tabs
AuthSessionContext uses the wildo-auth-tokens BroadcastChannel. Logout calls the backend, broadcasts LOGOUT, disconnects the live connection and clears local credentials. The receiver performs this selected cleanup from AuthSessionContext.tsx:
if (type === 'LOGOUT') {
logDebug('Received logout signal from another tab');
disconnect();
tokenStorage.clear();
getManualCallsHttpClient().setConsumableToken(null);
setResourcesConsumableToken(null);
storeAuthTokens(null);
getManualCallsHttpClient().setAuthToken(null);
setResourcesAuthToken(null);
setAuth(EMPTY_AUTH_STATE);
}
Clearing both the manual HTTP client and resource client matters: an empty React account display alone would leave requests carrying an old credential. Consumable-token state is cleared as well. The receiving tab does not rebroadcast logout.
Use the shared provider in custom screens
Call the provider’s logout operation rather than removing a storage item yourself. Token refresh is coordinated on the same channel so tabs can adopt the new access token; the HTTP-only refresh cookie remains outside JavaScript.
Know the browser boundary
BroadcastChannel coordinates same-origin tabs where the browser supports it. It does not reach another device or unrelated domain. Backend logout is still the credential authority, and sign-out-everywhere is the separate account-wide mechanism. The sender clears its local state even if the network logout call fails, so a visibly signed-out tab is not by itself proof of server-side revocation.