注销
Signing out a user
无论用户使用哪种方式登录,注销用户的方法都是一样的。
🌐 Signing out a user works the same way no matter what method they used to sign in.
从客户端库调用登出方法。它会移除活动会话并清除存储介质中的认证数据。
🌐 Call the sign out method from the client library. It removes the active session and clears Auth data from the storage medium.
async function () { const { } = await ..()}登出和权限范围 #
🌐 Sign out and scopes
Supabase Auth 允许你在用户在你的应用中调用 sign out API 时指定三种不同的范围:
🌐 Supabase Auth allows you to specify three different scopes for when a user invokes the sign out API in your application:
global(默认)当用户的所有会话都被终止时。local只会终止用户当前的会话,但其他设备或浏览器上的会话仍然保持活跃。others用来终止该用户除当前会话外的所有会话。
你可以通过提供 scope 选项来调用它们:
🌐 You can invoke these by providing the scope option:
JavaScript、Swift、Python 和 C# 默认使用 global 范围。Dart 和 Kotlin 默认使用 local。
🌐 JavaScript, Swift, Python, and C# default to the global scope. Dart and Kotlin default to local.
使用 global 范围时,在一个设备上调用 signOut() 会撤销该用户所有会话的刷新令牌,包括其他设备和浏览器。下次这些会话尝试刷新时,即使这些设备上没有人登出,也会失败并出现 AuthApiError: Invalid Refresh Token: Refresh Token Not Found。
🌐 With the global scope, calling signOut() on one device revokes the refresh tokens for every session that user has, including other devices and browsers. Those other sessions fail with AuthApiError: Invalid Refresh Token: Refresh Token Not Found the next time they try to refresh, even though no one signed out on that device.
如果你的应用希望每个设备都有独立的会话,请像下面的例子一样,明确传入 local 范围。
🌐 If your app expects independent sessions per device, pass the local scope explicitly, as shown in the examples below.
// defaults to the global scopeawait ..()// sign out from the current session onlyawait ..({ : 'local' })登出后,所有刷新令牌以及可能与受影响的会话相关的其他数据库对象都会被销毁,客户端库也会移除存储在本地存储介质中的会话。
🌐 Upon sign out, all refresh tokens and potentially other database objects related to the affected sessions are destroyed and the client library removes the session stored in the local storage medium.
被撤销会话的访问令牌在其过期时间之前仍然有效,这个时间编码在 exp 声明中。用户不会立即被登出,只有当访问令牌过期时才会被登出。
🌐 Access Tokens of revoked sessions remain valid until their expiry time, encoded in the exp claim. The user won't be immediately logged out and will only be logged out when the Access Token expires.