Jennie Robinson Faber
39eb9e039a
Users clicking sign-out in the wiki were getting 'xsrf token invalid'. The old logoutSource extracted the xsrf from oidc-provider's form into a separate short-lived cookie and bounced through /auth/logout-confirm, but that dance kept desyncing — the xsrf on the eventual submit didn't always match the session state on /oidc/session/end/confirm. Drop the custom confirmation page and auto-submit oidc-provider's own form inline from logoutSource. The xsrf stays inside the original form HTML the provider generated, so the validation is guaranteed to match. Clicking sign-out in the wiki is already confirmation enough. Also clear the Ghost Guild auth-token cookie in postLogoutSuccessSource so signing out of the wiki fully signs the user out rather than leaving a stale ghostguild.org session behind. |
||
|---|---|---|
| .. | ||
| api | ||
| config | ||
| emails | ||
| middleware | ||
| migrations | ||
| models | ||
| plugins | ||
| routes | ||
| utils | ||