Mirrors/gitea
0
0
Fork 0
mirror of https://github.com/go-gitea/gitea.git synced 2026-08-02 09:17:10 +02:00
Code Issues Activity

fix: skip OIDC end-session after password login for OAuth2 users (#38439)

Browse Source 
Fixes #38209

OAuth2-linked accounts that sign in via the password form were still
redirected to the provider end_session_endpoint on logout because the
redirect was keyed off account LoginType.

Store the session sign-in method (password vs oauth2) and only use
RP-initiated OIDC logout when this session was authenticated via OAuth2.
Sessions without the new key keep the previous LoginType behavior.

---------

Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
This commit is contained in:
Harsh Satyajit Thakur
2026-07-27 15:35:48 +00:00
committed by GitHub
co-authored by wxiaoguang
parent 559aa89ca7
commit e67dd4c818
5 changed files with 49 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files
modules/session/key.go
+6
View File
@@ -9,4 +9,10 @@ const (
KeyImpersonatorData = "impersonatorData"
KeyUserHasTwoFactorAuth = "userHasTwoFactorAuth"
// KeySignInMethod records how the current session was authenticated so logout
// can decide whether RP-initiated OIDC logout is appropriate.
KeySignInMethod = "signInMethod"
SignInMethodOAuth2 = "oauth2"
)