Create revoke endpoint
Nobody has claimed this yet.
- Dominant language
- TypeScript
- Stars
- 1
- Forks
- 3
- Avg merge
- 4m
- Merged PRs (30d)
- 1
Description
In certain environments, redirecting to /logout is not seamless (e.g. iOS Safari webviews). Sign-in runs in ASWebAuthenticationSession, so the auth server’s sid cookie lives in Safari’s jar, but logout runs in the WKWebView, which doesn’t send that cookie. The redirect may succeed locally, but the icssc server session is never invalidated — so silent SSO can still re-authenticate the user on next sign-in.
We should issue a revocable logout token at login, store it server-side in AntAlmanac, and revoke the icssc session via a back-channel POST during sign-out (no redirect / no ASW sheet on iOS).
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by tracing the login and sign-out flows in the repository, including where AntAlmanac communicates with the icssc auth server. Determine how a logout token could be issued and stored, then verify the back-channel revocation path avoids redirects and ASWebAuthenticationSession on iOS. Done means the server session is invalidated during sign-out and silent SSO cannot reuse it.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- typescript
- Domain
- api, authentication
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Quiet
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100