Repository navigation
Ghost Session: WebSocket Connection Leaks After Logout #1158
Description
The logout function in packages/api/src/EmbeddedChatApi.ts fails to disconnect the WebSocket client (this.rcClient). It only calls this.auth.logout(), which removes the authentication token but leaves the socket connection active. Consequently, the application continues to receive live messages and events for the previous session even after the user has visibly "logged out," leading to privacy leaks and inconsistent state if a new user logs in without a full page refresh.
Steps to reproduce:
- Login to EmbeddedChat and enter a room.
- Open the browser's Developer Tools and navigate to the Network tab.
- Filter by "WebSocket" to see the active connection.
- Call
api.logout()or click the Logout button in the UI. - Observe that the WebSocket connection remains active (status 101 Switching Protocols) and frames continue to be received.
Expected behavior:
Logout should fully terminate the session. The function must call this.rcClient.disconnect() and this.rcClient.unsubscribeAll() to clean up resources and stop receiving data.
Actual behavior:
The WebSocket connection remains active, and the client continues to receive real-time updates for the logged-out user's session.
Activity
kanaksharma9 commentedon Feb 25, 2026
Hey, I'd like to work on this issue, will share my findings soon.
rohanesor commentedon Oct 18, 2026
I'd like to work on this.
Confirmed still present on
develop(8c542970):EmbeddedChatApi.logout()only awaitsthis.auth.logout(), which clears the token but never tears down the realtime connection. The class already has aclose()method that stops_activeSubscriptionsand callssdk.connection.close()—logout()simply never calls it.Credit where due: @Aryan-Verma-999's earlier #1171 identified the same root cause; it was closed unmerged. I plan to build on that, with one difference: tearing down in a
finallyblock so the socket is also closed when the logout request itself fails (otherwise a failed logout still leaves a live session).Verification:
packages/apihas no test runner ("test": "echo \"Error: no test specified\""), so I'll verify manually via DevTools → Network → WS, showing the connection open after logout ondevelopand closed after the fix, and include before/after captures.fix: close realtime connection on logout to prevent ghost sessions (R…