Conversation
…ession exists changelog: Bug Fixes, Logout, Consistently handle logout request for logged out user if session terminated by sign-in with another browser
| def redirect_url | ||
| request.env["devise_#{warden_message}_failure_redirect_url"] || super | ||
| end |
There was a problem hiding this comment.
The way this works is we assume that a concurrent session logout throw will be handled by Devise's failure app responder. By default, this would redirect to the new_user_session_url. We're intercepting it to redirect them to the same place they originally intended, with the expectation that the user would be fully logged out at that point. It's not ideal that this incurs an additional redirect hop, but this gives the best assurance that Warden has a nil user object, since our concurrent session logout behavior only occurs after Warden has already loaded and assigned the user who's being signed out.
kevinsmaster5
left a comment
kevinsmaster5
left a comment
There was a problem hiding this comment.
Looks good and works locally for me. I appreciate the comments - they help give insight to what's going on there.
Co-authored-by: Zach Margolis <zachmargolis@users.noreply.github.com>
Co-authored-by: Zach Margolis <zachmargolis@users.noreply.github.com>
Storing the locale in these places leads to a call to `current_user` which trips the session limitable raise before `devise_session_limited_failure_redirect_url` is set by these controllers. This commit resolves this issue by not calling the before action for controller actions that set `devise_session_limited_failure_redirect_url` See #9842
5 participants
🎫 Ticket
LG-11777
Related issue: #9407
🛠 Summary of changes
Updates the behavior of the OIDC and SAML logout actions to prevent a user from being sent to the sign-in page if their session is terminated by the
session_limitablelogic (concurrent browser session), treating them as if they had already been logged-out, and inheriting the existing expected behavior[1][2] for redirecting a logged-out user.📜 Testing Plan
Observe that you are redirected back to the sample application as a completed logout.