Jennie Robinson Faber
39eb9e039a
Users clicking sign-out in the wiki were getting 'xsrf token invalid'. The old logoutSource extracted the xsrf from oidc-provider's form into a separate short-lived cookie and bounced through /auth/logout-confirm, but that dance kept desyncing — the xsrf on the eventual submit didn't always match the session state on /oidc/session/end/confirm. Drop the custom confirmation page and auto-submit oidc-provider's own form inline from logoutSource. The xsrf stays inside the original form HTML the provider generated, so the validation is guaranteed to match. Clicking sign-out in the wiki is already confirmation enough. Also clear the Ghost Guild auth-token cookie in postLogoutSuccessSource so signing out of the wiki fully signs the user out rather than leaving a stale ghostguild.org session behind. |
||
|---|---|---|
| .. | ||
| activityLog.js | ||
| adminAlerts.js | ||
| auth.js | ||
| checkSlackJoins.js | ||
| escapeHtml.js | ||
| escapeRegex.js | ||
| helcim.js | ||
| memberNumber.js | ||
| mongoose.js | ||
| oidc-mongodb-adapter.ts | ||
| oidc-provider.ts | ||
| outline.js | ||
| resend.js | ||
| schemas.js | ||
| slack.ts | ||
| syncWikiArticles.js | ||
| tickets.js | ||
| validateBody.js | ||
| validateTagSlugs.js | ||