pgadmin-org / pgadmin-org/pgadmin4
[LOG_AUTHENTICATED_USER] missing name when logout
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 3.8k
- Forks
- 891
- Avg merge
- 4d 7h
- Merged PRs (30d)
- 8
Description
Please note that security bugs or issues should be reported to security@pgadmin.org.
Describe the bug
Hello,
sine the new feature to log authenticated user has been done here, it seems that when you logout, username is not displayed in log.
Here an example with logout from oauth2:
1.2.3.4 - - [11/Sep/2026:06:37:07 +0000] "GET /oauth2/logout?next=/browser/ HTTP/1.1" 302 6269 "https://pgadmin4.youpi.fr/browser/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36"
Here an example with "classical" logout:
1.2.3.4 - - [11/Sep/2026:06:34:21 +0000] "GET /logout?next=/browser/ HTTP/1.1" 302 205 "https://pgadmin4.youpi.fr/browser/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36"
To Reproduce
Deploy pgadmin4 and enable LOG_AUTHENTICATED_USER, click on Logout button.
Expected behavior
Add missing username in log:
1.2.3.4 - me@youpi.fr [11/Sep/2026:06:34:21 +0000] "GET /logout?next=/browser/ HTTP/1.1" 302 205 "https://pgadmin4.youpi.fr/browser/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36"
Desktop (please complete the following information):
- OS: Kubernetes 1.34.8
- pgAdmin version: 9.17
- Mode: Server
- Browser (if running in server mode): Chrome/152.0.0.0
- Package type: Container
Thanks a lot
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the /logout and /oauth2/logout entry points and trace how LOG_AUTHENTICATED_USER adds usernames to request logs. Reproduce both logout flows with the setting enabled, then add or update coverage for the expected access-log username. Done means both logout requests log the authenticated username before the session ends.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- authentication, backend
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 68/100