julianlam / nodebb-plugin-session-sharing

Allows login sessions from your app to persist in NodeBB
MIT License
86 stars 66 forks source link

Can't logout from the admin menu #137

Open arkabase opened 4 months ago

arkabase commented 4 months ago

NodeBB v3.7.0 Logged in with admin user. When I click on logout at the bottom of the admin menu I am redirected to the forum homepage but still logged in. The user menu logout button works fine.

In the logs with verbose active :

[session-sharing] Payload verified
[session-sharing] Processing login for uid 1, path /le-forum/
[UserReset.cleanByUid] No tokens found for uid (1).
[session-sharing] Payload verified
[session-sharing] Re-validated login for uid 1, path /le-forum/admin
...
[user.auth] Revoking session uoe71iyPtT3YSaFMl_hIpVW3L2czgX-Q for user 1
[session-sharing] Payload verified
[session-sharing] Processing login for uid 1, path /le-forum/
[UserReset.cleanByUid] No tokens found for uid (1).

You can see the first login with the shared cookie payload, revalidated for admin access, then revokation of the session on logout, but the cookie is not deleted so the plugin revalidate the login on the homepage. Does not the cookie need to be deleted on logout ?