fix(auth): GET /v1/auth/logout 302s directly to url; /logout page lands on / #70
No reviewers
Labels
No labels
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
psa-systems/bunyip!70
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "fix/logout-honors-final-url"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Two related changes so a "Log out" click actually feels like signing out, instead of bouncing through another login screen.
GET /v1/auth/logout?url=<x>(bunyip-api). Previously: clear cookies, then 302 to{web_origin}/login?redirect={url}&checked=1. The param nameurlimplied "where to send the browser afterwards", but the handler treated it as "where to send the browser AFTER the user signs back in", forcing every caller to land on the Bunyip login form. Child-app SPAs (mokosh-clients) that called this endpoint to clean up the SSO session ended up on the Bunyip login form instead of their own landing page. Now: clear cookies, 302 directly tourl. The same domain validation still applies, so logout cannot redirect off the apex; what changes is the path between "cookies cleared" and "browser arrives". This matches the OIDC RP-initiated logout shape (post_logout_redirect_uri).GET /logout(bunyip-web). Previously: post-logout target was always/login. Same UX problem: clicking "Log out" served a login form. Now: default target is/(bunyip homepage). The?redirect=query param escape hatch is preserved for callers that genuinely want the post-logout login-then-redirect chain (session-timeout banners, expired-cookie recovery), so existing flows that pass?redirect=/somethingkeep working.Companion mokosh-clients change to point the SPA's logout
urlat its own origin (msp.a8n.systems) ships separately.Two related changes so a "Log out" click actually feels like signing out, instead of bouncing through another login screen. `GET /v1/auth/logout?url=<x>` (bunyip-api). Previously: clear cookies, then 302 to `{web_origin}/login?redirect={url}&checked=1`. The param name `url` implied "where to send the browser afterwards", but the handler treated it as "where to send the browser AFTER the user signs back in", forcing every caller to land on the Bunyip login form. Child-app SPAs (mokosh-clients) that called this endpoint to clean up the SSO session ended up on the Bunyip login form instead of their own landing page. Now: clear cookies, 302 directly to `url`. The same domain validation still applies, so logout cannot redirect off the apex; what changes is the path between "cookies cleared" and "browser arrives". This matches the OIDC RP-initiated logout shape (`post_logout_redirect_uri`). `GET /logout` (bunyip-web). Previously: post-logout target was always `/login`. Same UX problem: clicking "Log out" served a login form. Now: default target is `/` (bunyip homepage). The `?redirect=` query param escape hatch is preserved for callers that genuinely want the post-logout login-then-redirect chain (session-timeout banners, expired-cookie recovery), so existing flows that pass `?redirect=/something` keep working. Companion mokosh-clients change to point the SPA's logout `url` at its own origin (msp.a8n.systems) ships separately.