huggingface / huggingface/chat-ui

For openID authentication, logout button should call /logout url of Authentication service

Open
#577 11 comments 1 reaction 1 assignee Claimed by @nsarrazin View on GitHub
back bug
Dominant language
TypeScript
Stars
11k
Forks
1.7k
Avg merge
21h 24m
Merged PRs (30d)
56

Description

Situation: I'm using openID connect to authenticate my users through the app. Login works perfectly

Complication: The sign-out button doesn't do anything because it only deletes local cookies. If I press "sign in" again, it goes straight through login as we didn't clear the session in the OpenID authentication service (I think that's what happens?)

Solutions: I'm not familiar with authentication protocols, but reading a bit I understand we would need to fully logout the user by calling the url: [https://login.microsoftonline.com/{tenant}/oauth2/v2.0/logout?](https://login.microsoftonline.com/%7Btenant%7D/oauth2/v2.0/logout?post_logout_redirect_uri=%7Byour_redirect_uri%7D)

Currently the logout button only deletes cookies:

cookies.delete(COOKIE_NAME, {
path: "/",
// So that it works inside the space's iframe
sameSite: dev ? "lax" : "none",
secure: !dev,
httpOnly: true,
});

I'm not familiar with authentication protocols, but reading a bit I understand we would need to fully logout

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.