pgadmin-org / pgadmin-org/pgadmin4

[LOG_AUTHENTICATED_USER] missing name when logout

Open
#10,409 4 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Bug
Dominant language
Python
Stars
3.8k
Forks
891
Avg merge
4d 7h
Merged PRs (30d)
8

Description

Please note that security bugs or issues should be reported to security@pgadmin.org.

Describe the bug

Hello,

sine the new feature to log authenticated user has been done here, it seems that when you logout, username is not displayed in log.

Here an example with logout from oauth2:

1.2.3.4 - - [11/Sep/2026:06:37:07 +0000] "GET /oauth2/logout?next=/browser/ HTTP/1.1" 302 6269 "https://pgadmin4.youpi.fr/browser/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36"

Here an example with "classical" logout:

1.2.3.4 - - [11/Sep/2026:06:34:21 +0000] "GET /logout?next=/browser/ HTTP/1.1" 302 205 "https://pgadmin4.youpi.fr/browser/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36"

To Reproduce
Deploy pgadmin4 and enable LOG_AUTHENTICATED_USER, click on Logout button.

Expected behavior

Add missing username in log:

1.2.3.4 - me@youpi.fr [11/Sep/2026:06:34:21 +0000] "GET /logout?next=/browser/ HTTP/1.1" 302 205 "https://pgadmin4.youpi.fr/browser/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36"

Desktop (please complete the following information):

  • OS: Kubernetes 1.34.8
  • pgAdmin version: 9.17
  • Mode: Server
  • Browser (if running in server mode): Chrome/152.0.0.0
  • Package type: Container

Thanks a lot

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the /logout and /oauth2/logout entry points and trace how LOG_AUTHENTICATED_USER adds usernames to request logs. Reproduce both logout flows with the setting enabled, then add or update coverage for the expected access-log username. Done means both logout requests log the authenticated username before the session ends.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
authentication, backend
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
68/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.