Google OAuth2 - ALWAYS prompt for a password

[PHermans1]

Hello,
I am beyond frustrated and need help. I am using django-allauth and want users to login only with Google. This works fine the first time I login, but if I am using Chrome (or safari for that matter) and login to my site, then logout.....and another user approaches computer and tries to login, they are given (by google) a list of accounts to choose from or to "switch accounts".....so they decide to click on my username......frickin google auto logs them in without asking for a password!

I have tried everything I can find, including things like:

ACCOUNT_REAUTHENTICATION_REQUIRED=True

SOCIALACCOUNT_PROVIDERS = {
    'google': {
        'SCOPE': ['profile', 'email', ],
        'AUTH_PARAMS': {
            'access_type': 'online',
            'prompt': 'login',
            },
    }
}

in settings, which seem to have absolutely no effect at all.

I have tried using a signal:

def handle_user_logged_out(request, user, **kwargs):
    print(f'User logged out: {user.email}')

    # Check if the user is a student
    if hasattr(user, 'is_student') and user.is_student:
        social_accounts = user.socialaccount_set.filter(provider='google')
        for account in social_accounts:
            try:
                token = SocialToken.objects.get(account=account)
                access_token = token.token

                # Revoke the token
                revoke_url = f'https://oauth2.googleapis.com/revoke?token={access_token}'
                response = requests.post(revoke_url)

                if response.status_code == 200:
                    print('Google access token successfully revoked.')
                else:
                    print(f'Failed to revoke Google access token. Status code: {response.status_code}, Response: {response.text}')

            except SocialToken.DoesNotExist:
                print(f'No social token found for the account with provider {account.provider}.')
    else:
        print(f'User {user.email} is not a student, no token revocation needed.')

and i have tried a custom adapter:

class CustomSocialAccountAdapter(DefaultSocialAccountAdapter):

    def is_open_for_signup(self, request, sociallogin):
        # Logic to determine if signup is allowed
        allow_signup = bool(sociallogin)
        return allow_signup

    def pre_social_login(self, request, social_login):
        # Check if the user is already authenticated
        if request.user.is_authenticated:
            return

        # Check if the user is logging in with a social account that already exists
        if social_login.is_existing:
            return

        # Check for an email in the social account data
        email = social_login.account.extra_data.get('email')
        if not email:
            return

        email = email.lower()

        # Check if a user with the same email exists
        try:
            user = User.objects.get(email=email)

            # If the user exists and is active, link the social account
            if user and user.is_active:
                social_login.connect(request, user)

                # Verify the user's email if not already verified
                if not EmailAddress.objects.filter(user=user, verified=True).exists():
                    EmailAddress.objects.get_or_create(
                        user=user,
                        email=email,
                        verified=True
                    )

                # Mark the social account as trusted (optional)
                social_account = social_login.account
                social_account.extra_data['trusted'] = True
                social_account.save()

        except User.DoesNotExist:
            # Handle case where no matching user exists
            template_name = 'socialaccount/oauth2_error.html'
            template = loader.get_template(template_name)
            school_admin_group = Group.objects.get(name='school_admin')
            school_admin_users = User.objects.filter(groups=school_admin_group)

            school_admin_users_info = [
                {"first_name": user.first_name, "last_name": user.last_name, "email": user.email}
                for user in school_admin_users
            ]

            context = {
                'error_message': f'Credentials were valid, but {email} has not been authorized to use the application.',
                'school_admin_users': school_admin_users_info,
            }

            # Use a proper response or redirect
            response = HttpResponse(template.render(context, request))
            raise ImmediateHttpResponse(response)
   
    def get_auth_params(self, request, action):
        params = super().get_auth_params(request, action)
        params['prompt'] = 'login'  # Force Google to prompt for login every time
        return params

It seems that no matter what I do, Google lets any idiot login using my name.

I have tried incognito mode - not helful.
I have tried "Guest Mode" which helps only if the browser is closed fully.....which I can't (and shouldn't have to) do from my web app

Any guidance you can provide would be greatly appreciated! I am so confused at this point, I am not even sure what to add to help anyone out there help me....hopefully this is enough.

[PHermans1]

I also tried adding to the auth_params in the provider configuration but that made no difference. In the end, the issue is that it is a public computer and when someone logs out of my site they should automatically also be logged out of google. I am struggling to make this happen, and without it there is essentially 0 security which defeats the whole purpose of using a login page at all.