From 8b2ab0c77699268ec1460e0f556bcbd16580860e Mon Sep 17 00:00:00 2001
From: cclohmar <claus.lohmar@lohmar.co.uk>
Date: Mon, 15 Jun 2026 06:46:10 +0000
Subject: [PATCH] fix(auth): proper logout with domain cookie and Authelia
 end-session

---
 src/main.go | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/src/main.go b/src/main.go
index ad4c9b3..2030d44 100644
--- a/src/main.go
+++ b/src/main.go
@@ -7,6 +7,7 @@ import (
 	"fmt"
 	"log/slog"
 	"net/http"
+	"net/url"
 	"os"
 	"os/signal"
 	"path/filepath"
@@ -122,16 +123,20 @@ func main() {
 	mux.HandleFunc("GET /auth/callback", oidcHandler.Callback)
 	mux.HandleFunc("POST /auth/callback", oidcHandler.Callback)
 	mux.HandleFunc("GET /auth/logout", func(w http.ResponseWriter, r *http.Request) {
-		// Clear session cookie
+		// Clear session cookie (with domain to match)
 		http.SetCookie(w, &http.Cookie{
 			Name:     "nextwks_session",
 			Value:    "",
 			Path:     "/",
+			Domain:   cfg.OIDC.Domain,
 			MaxAge:   -1,
 			HttpOnly: true,
 			SameSite: http.SameSiteStrictMode,
 		})
-		http.Redirect(w, r, "/auth/login", http.StatusFound)
+		// Redirect to Authelia's end session to also clear the Authelia session
+		logoutURL := fmt.Sprintf("%s/api/oidc/end-session?client_id=%s&post_logout_redirect_uri=%s",
+			cfg.OIDC.IssuerURL, cfg.OIDC.ClientID, url.QueryEscape(cfg.OIDC.RedirectURL))
+		http.Redirect(w, r, logoutURL, http.StatusFound)
 	})
 
 	// --- Workspace launcher (public, but OIDC-protected) ---