search

WeblateOrg / weblate

Web based localization tool with tight version control integration.
https://weblate.org/
GNU General Public License v3.0
4.66k stars 1.02k forks source link

Cannot stay logged out when only sign in provider is a single SSO #10159

Closed andrew-mantha-rcgt closed 3 months ago

andrew-mantha-rcgt commented 1 year ago

Describe the issue

When there is no anonymous access and the only sign in provider is a single SSO, Weblate helpfully redirects users to the SSO Login Portal. Assuming their SSO Login creds are still cached, the login will succeed and the user is redirected back at Weblate.

This is helpful when opening the first page, but not helpful when a user attempts to log out. They cannot easily end the session, as the logout page will redirect the user back into the SSO provider, which will log them back in.

I already tried

Steps to reproduce the behavior

  1. Configure a single SSO Provider and disable the email login provider.
  2. Log in via the SSO Provider.
  3. Click the Log Out button
  4. User is automatically redirected back into their SSO Login Provider. If the SSO Provider has a cached login, they will be fully logged back in to Weblate.

Expected behavior

User lands on a page that tells them they've successfully logged out. They are not automatically logged back in.

This allows a user to specifically end their session and reduce exposure to things like Session hijacking attacks.

Screenshots

No response

Exception traceback

No response

How do you run Weblate?

Docker container

Weblate versions

Weblate deploy checks

SystemCheckError: System check identified some issues:

CRITICALS:
?: (weblate.E003) Cannot send e-mail ([Errno 99] Cannot assign requested address), please check EMAIL_* settings.
    HINT: https://docs.weblate.org/en/weblate-5.0.2/admin/install.html#out-mail

INFOS:
?: (weblate.I021) Error collection is not set up, it is highly recommended for production use
    HINT: https://docs.weblate.org/en/weblate-5.0.2/admin/install.html#collecting-errors
?: (weblate.I028) Backups are not configured, it is highly recommended for production use
    HINT: https://docs.weblate.org/en/weblate-5.0.2/admin/backup.html

System check identified 3 issues (1 silenced).

Additional context

No response

github-actions[bot] commented 1 year ago

This issue has been added to the backlog. It is not scheduled on the Weblate roadmap, but it eventually might be implemented.

In case you need this feature soon, please consider helping or push it by funding the development.

yvanzo commented 3 months ago

This issue has been reported for our instance of Weblate too. See https://community.metabrainz.org/t/logout-in-weblate-not-working/711433?u=yvanzo

github-actions[bot] commented 3 months ago

Thank you for your report; the issue you have reported has just been fixed.

github-actions[bot] commented 3 months ago

Thank you for your report; the issue you have reported has just been fixed.