From 8ca374e65768d396a988bcbeb0e1bfd5b95b6b9a Mon Sep 17 00:00:00 2001 From: Mathias Date: Wed, 3 Jun 2026 21:49:08 +0200 Subject: [PATCH] fix(web): logout redirects to /welcome, not /auth/login MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Logout was bouncing the just-logged-out visitor straight back into a Dex login. Land them on the public /welcome page instead — an intentional UX fix. Cookie clearing and server-side session deletion are unchanged. Co-Authored-By: Claude Opus 4.8 (1M context) --- internal/web/oidc/oidc.go | 4 +++- internal/web/oidc/oidc_test.go | 1 + 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/internal/web/oidc/oidc.go b/internal/web/oidc/oidc.go index 55e1c3a..ca3c956 100644 --- a/internal/web/oidc/oidc.go +++ b/internal/web/oidc/oidc.go @@ -266,7 +266,9 @@ func (d *DexAuth) handleLogout(w http.ResponseWriter, r *http.Request) { d.sessions.delete(sid) } d.clearSessionCookie(w) - http.Redirect(w, r, loginPath, http.StatusFound) + // Land on the public landing page, not the login endpoint: a just-logged-out + // visitor should see /welcome, not be bounced straight back into a Dex login. + http.Redirect(w, r, "/welcome", http.StatusFound) } // redirectUnauthenticated sends an unauthenticated visitor somewhere useful: the diff --git a/internal/web/oidc/oidc_test.go b/internal/web/oidc/oidc_test.go index d1614a0..e0ca192 100644 --- a/internal/web/oidc/oidc_test.go +++ b/internal/web/oidc/oidc_test.go @@ -304,6 +304,7 @@ func TestLogoutClearsSession(t *testing.T) { auth.Routes().ServeHTTP(rec, req) require.Equal(t, http.StatusFound, rec.Code) + require.Equal(t, "/welcome", rec.Header().Get("Location"), "logout lands on the public page") cleared := sessionCookie(t, rec.Result()) require.Less(t, cleared.MaxAge, 0, "logout expires the cookie")