rbrooks/Quest-Board
Watch
1
0
Fork
You've already forked Quest-Board
 0
Code Issues 59 Pull requests 7 Projects Releases 76 Packages Wiki Activity Actions 2

fix(webapp): signing out is a POST; GET /auth/logout ends nothing (#1163) #1165

Merged
claude-bot merged 2 commits from fix/1163-logout-is-a-post into main 2026-10-13 03:42:34 +00:00
Conversation 0 Commits 2 Files changed 13 +256 -20
claude-bot commented 2026-10-13 02:46:38 +00:00
Collaborator
Copy link

Part of #1163 (the logout piece; the other GET routes that write stay open there).

GET /auth/logout ended the session, so following any link to it logged the reader out.

  • POST /auth/logout ends the session and clears the cookie, answering 200 {"redirect": "<APP_URL>/login"}; the frontend navigates. There was no OIDC end-session redirect to preserve.
  • GET /auth/logout now only redirects to /. It touches no session.
  • Cross-site protection is the session cookie's SameSite=Lax, the same as every other cookie-authenticated write; the backend has no CSRF token or Origin check, and none is added here.
  • A failed sign-out no longer looks like a successful one: the user stays in the signed-in frame with "You are still signed in. Try again." The one exception is after account deletion, where the session is already dead.
  • The PWA needs no change (/auth/ is network-only and Workbox routes match GET).

No bot API change, no migration.

Verified

On docker-test: test_auth_logout.py (new), test_auth_routes.py, test_auth_callback.py (28 passed); ruff; changelog and version checks; frontend lint; vitest for auth.test.js, AppFrame.test.jsx, Profile.test.jsx, AccountMenu (168 passed).

Not run: the journeys (their signOut fixture now POSTs) and the full backend suite; left to CI.

🤖 Generated with Claude Code

Part of #1163 (the logout piece; the other GET routes that write stay open there). `GET /auth/logout` ended the session, so following any link to it logged the reader out. - `POST /auth/logout` ends the session and clears the cookie, answering 200 `{"redirect": "<APP_URL>/login"}`; the frontend navigates. There was no OIDC end-session redirect to preserve. - `GET /auth/logout` now only redirects to `/`. It touches no session. - Cross-site protection is the session cookie's `SameSite=Lax`, the same as every other cookie-authenticated write; the backend has no CSRF token or Origin check, and none is added here. - A failed sign-out no longer looks like a successful one: the user stays in the signed-in frame with "You are still signed in. Try again." The one exception is after account deletion, where the session is already dead. - The PWA needs no change (`/auth/` is network-only and Workbox routes match GET). No bot API change, no migration. ## Verified On `docker-test`: `test_auth_logout.py` (new), `test_auth_routes.py`, `test_auth_callback.py` (28 passed); ruff; changelog and version checks; frontend lint; vitest for `auth.test.js`, `AppFrame.test.jsx`, `Profile.test.jsx`, `AccountMenu` (168 passed). Not run: the journeys (their `signOut` fixture now POSTs) and the full backend suite; left to CI. 🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
fix(webapp): a failed sign-out keeps you signed in and says so (#1163)
All checks were successful
CI / Bot/backend version sync (pull_request) Successful in 40s
Details
CI / Summarisation accuracy eval harness (stub provider) (pull_request) Successful in 1m10s
Details
CI / Backend lint (ruff) (pull_request) Successful in 48s
Details
CI / Feedback site tests (pull_request) Successful in 1m2s
Details
CI / Does this change touch the recording path? (pull_request) Successful in 30s
Details
CI / Synthetic session harness (no GPU, no LLM) (pull_request) Has been skipped
Details
CI / Bot tests and audit (pull_request) Successful in 2m20s
Details
CI / Docker image build (pull_request) Successful in 3m8s
Details
CI / Frontend (shard 2/2) (pull_request) Successful in 9m41s
Details
CI / Frontend (shard 1/2) (pull_request) Successful in 12m6s
Details
CI / End-to-end journeys (phone) (pull_request) Successful in 15m4s
Details
CI / End-to-end journeys (keyboard) (pull_request) Successful in 19m24s
Details
CI / End-to-end journeys (desktop) (pull_request) Successful in 19m40s
Details
CI / Backend migration, tests, and audit (pull_request) Successful in 33m5s
Details
af34d22fd9 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
claude-bot deleted branch fix/1163-logout-is-a-post 2026-10-13 03:42:35 +00:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
backend
Issue related to the backend

  
bot
Issue related to the bot

  
bug
Something is not working

  
duplicate
This issue or pull request already exists

  
enhancement
New feature

  
frontend
Issue related to the frontend

  
help wanted
Need some help

  
invalid
Something is wrong

  
question
More information is needed

  
recording
Issue related to the recording system

  
security
Security hardening / vulnerability work

  
wontfix
This won't be fixed

No labels
backend
bot
bug
duplicate
enhancement
frontend
help wanted
invalid
question
recording
security
wontfix
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
rbrooks/Quest-Board!1165
No description provided.