From 2489ac589e97ee09889d8d3d58bc75ff5d0f18df Mon Sep 17 00:00:00 2001 From: cclohmar Date: Mon, 15 Jun 2026 08:07:54 +0000 Subject: [PATCH] fix(auth): force re-login via prompt=login for proper logout --- src/main.go | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/src/main.go b/src/main.go index f2c1ff5..42b54e3 100644 --- a/src/main.go +++ b/src/main.go @@ -133,8 +133,9 @@ func main() { HttpOnly: true, SameSite: http.SameSiteLaxMode, }) - // Redirect to Authelia's logout page, then back to workspace - logoutURL := fmt.Sprintf("%s/logout?rd=%s", cfg.OIDC.IssuerURL, url.QueryEscape(cfg.OIDC.RedirectURL)) + // Clear NextWks session, force re-login via Authelia + logoutURL := fmt.Sprintf("%s/api/oidc/authorize?prompt=login&response_type=code&client_id=%s&redirect_uri=%s&scope=openid+profile+email&state=logout&nonce=logout", + cfg.OIDC.IssuerURL, url.QueryEscape(cfg.OIDC.ClientID), url.QueryEscape(cfg.OIDC.RedirectURL)) http.Redirect(w, r, logoutURL, http.StatusFound) })