kevinveenbirkenbachandClaude Opus 5.5 32cdba9ea0 fix(sys-front-inj-logout): leave a role-injected logout control to its own handler ...

Prometheus, Baserow, Checkmk and Jitsi inject their own logout button, mark it with data-injected-logout and send it to /oauth2/sign_out?rd=<Keycloak logout>. The shared logout script matched the same button through that attribute name and bound a second handler that navigates straight to Keycloak, which cancelled the sign_out request: on the prometheus+tor pass of fork run 40042690056 (job odoo#0) the request shows as ERR_ABORTED 12 ms before the Keycloak logout page loads, the onion oauth2-proxy log records no sign_out, and the session survived the logout. On clearnet the logout service's per-domain sweep hid it.

The scan now skips any element carrying data-injected-logout. All four roles set the link and the handler themselves from lookup('sso', ..., 'logout_url'), so their destination does not change.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-10-24 16:19:28 +02:00

..

roles

fix(sys-front-inj-logout): leave a role-injected logout control to its own handler

2026-10-24 16:19:28 +02:00

utils

feat(test-e2e-playwright): run each role on one of its served networks

2026-09-24 21:59:07 +02:00