Re: Bug during logout

On Tue, 11 Aug 2026 at 11:30, Jonathan Gonzalez V. <jonathan(at)abdiel(dot)eu>
wrote:

>
> Hello!
>
> Magnus Hagander <magnus(at)hagander(dot)net> writes:
> > So a few things on the patch:
> >
> > 1. This would be the *only* test in the codebase :) I think fixing that
> scenario should be kept to a separate patch - it clearly
> > would be good to have them, buth aving *one* makes not much sense. Also,
> what's up with enabling ESI on the tests -- then
> > you require Varnish to run the tests properly.
>
> Well, having the first test it's the starting point, and patch should
> always carry their own when is possible, this helps to avoid making the
> same mistake in the future. Well, having *one* tests it's the starting
> point, nothing make sense without the first one right? About the ESI,
> yeah if you run the tests with a Varnish in front to test the full
> infrastructure it will make sense, but clearly not the case, I remove it.
>

I think most people don't have varnish in their dev env, but I might be
wrong :)

> 2. It seems you assign a "post" variable to the sitenav structure, whichi
> s then never used because you instead hardcode the
> > URL in the template? (FWIW I do think using the variable is the right
> thing, but then it should be used)
>
> Yeah! It was in between the work I was doing and forgot the change, yeah
> the idea is that any thing that it's a post go with a form, but, later
> my thought was "ok the logout", so, there will be anything else except
> the logout that it's going to be a post? anyway, yes I changed it!
>
> > 3. This does not cover the case of "distributed logout". That is, there
> are GET links in the community auth system that does the
> > same. If we actually care about not being able to log out that way, we'd
> need to fix that too?
>
> Uhmm, when you mean "distributed logout", you mean when people use the
> OAuth capabilities provided by postgresql.org right? Well, I think that
>

It's not OAuth, it's a custom protocol, but yes, that.

> logging out from a website it goes in the website, but if we want to
> have a logout control it should be in the panel that mange the session
> of the PostgreSQL OAuth system, so that panel should have the session
> per site, and from there it should logout other systems, so the webpage
> logout only that, the webpage.
>

Actually, I looked at it a bit, and the distributed logout actually uses a
different endpoint. But we might want to look into that one as well :)

But now I'm curious, there's any panel that manage the session in other
> sites like 2026.pgconf.eu, etc ? In that case, probably we can do
> something on that side in another patch!
>
>
Yes, for example https://www.postgresql.eu/account/ has a logout in
bottom-left as well.

//Magnus