---
title: "Verify cancelling SSO returns safely to the application"
description: "Test the cancellation branch of a sandbox identity-provider login and ensure the application preserves a usable signed-out state and retry path."
canonical_url: "https://vostride.com/agent-library/authentication/sso-cancel-return.md"
md_url: "https://vostride.com/agent-library/authentication/sso-cancel-return.md"
content_kind: "recipe"
topic: "authentication"
---

# Verify cancelling SSO returns safely to the application

Test the cancellation branch of a sandbox identity-provider login and ensure the application preserves a usable signed-out state and retry path.

## Risk

SSO cancellation is a normal user action. A broken callback can leave an endless spinner, create a partial session, or strand the user on an identity-provider error page that offers no route back to the application.

## Fixtures

- A sandbox identity-provider tenant with a test-owned account and configured application callback.
- A clean signed-out application session and a private workspace destination.
- A documented provider cancellation control and an application session inspection hook.

## Steps

1. Open the private workspace link and choose the configured SSO sign-in option; verify the sandbox provider and application identity shown on the consent or login page.
2. Use the provider cancellation control before completing authentication and verify the browser returns to the application.
3. Verify the application shows a comprehensible cancelled or unsuccessful sign-in state with an enabled retry action rather than an indefinite loading indicator.
4. Open the private workspace URL again and verify it still requires authentication; inspect the application session through the registered hook.
5. Retry SSO and complete it with the fixture account, then verify the correct workspace and account identity appear.

## Expected results

- Cancellation creates no complete application session and reveals no private workspace content.
- The callback resolves into a stable signed-out interface that permits retry.
- A subsequent successful SSO attempt reaches the originally permitted workspace without inheriting stale error state.

## False-pass traps

- A provider-hosted cancellation page is not evidence that the application handled its callback.
- An existing application session can hide an unintended partial-session transition.

## Cleanup

- Sign out of the application and clear only the disposable provider session associated with the fixture.

## Use with agent-qa

Adapt this test design to your application's acceptance criteria and configured target using the [recipe execution guide](/agent-library/software-factory/turn-a-recipe-into-an-agent-qa-test.md). External fixture setup and non-UI checks require your own supported hooks or test tooling. Validate the authored test, execute it, and inspect the completed evidence; this recipe is not a recorded test result.

## References

- [agent-qa test](/docs/agent-qa/configuration/test.md)
- [agent-qa hooks](/docs/agent-qa/guides/hooks.md)
- [agent-qa auth state](/docs/agent-qa/guides/auth-state.md)

- [Authentication QA recipes](/agent-library/authentication.md)
- [Software factory QA library](/agent-library.md)