diff --git a/bp/auth/routes.py b/bp/auth/routes.py index 6bcbfb7..4d85aa7 100644 --- a/bp/auth/routes.py +++ b/bp/auth/routes.py @@ -201,7 +201,6 @@ def register(url_prefix="/auth"): @auth_bp.post("/logout/") async def logout(): qsession.pop(SESSION_USER_KEY, None) - # Chain through all client apps to clear their sessions too return redirect(url_for("auth.sso_logout")) @auth_bp.get("/clear/") @@ -214,21 +213,25 @@ def register(url_prefix="/auth"): @auth_bp.get("/sso-logout/") async def sso_logout(): - """SSO logout: clear account session, then chain through all client - apps so each clears its own first-party session cookie.""" + """SSO logout: clear account session, then render a page with hidden + iframes that clear each client app's first-party session cookie. + Tolerates dead apps — iframes that fail are silently ignored.""" qsession.pop(SESSION_USER_KEY, None) from shared.infrastructure.urls import blog_url, market_url, cart_url, events_url, federation_url - from urllib.parse import quote - # Build redirect chain: blog → market → cart → events → federation → blog home - final = blog_url("/") - chain = federation_url(f"/auth/sso-clear?next={quote(final, safe='')}") - chain = events_url(f"/auth/sso-clear?next={quote(chain, safe='')}") - chain = cart_url(f"/auth/sso-clear?next={quote(chain, safe='')}") - chain = market_url(f"/auth/sso-clear?next={quote(chain, safe='')}") - chain = blog_url(f"/auth/sso-clear?next={quote(chain, safe='')}") + clear_urls = [ + blog_url("/auth/sso-clear"), + market_url("/auth/sso-clear"), + cart_url("/auth/sso-clear"), + events_url("/auth/sso-clear"), + federation_url("/auth/sso-clear"), + ] - return redirect(chain) + return await render_template( + "auth/signing_out.html", + clear_urls=clear_urls, + final_url=blog_url("/"), + ) return auth_bp diff --git a/shared b/shared index a93a456..9a637c6 160000 --- a/shared +++ b/shared @@ -1 +1 @@ -Subproject commit a93a456ac56e862f8a66d39660a331d1eb326d87 +Subproject commit 9a637c6227e5238ea9539801f9f7d01e97b53872 diff --git a/templates/auth/signing_out.html b/templates/auth/signing_out.html new file mode 100644 index 0000000..dc22e6e --- /dev/null +++ b/templates/auth/signing_out.html @@ -0,0 +1,21 @@ +{% extends "_types/root/_index.html" %} +{% block meta %}{% endblock %} +{% block title %}Signing out — Rose Ash{% endblock %} +{% block content %} +
You will be redirected shortly.
+