From 7ed9b9d7a2c39abed31b6903aef32196031c9c5c Mon Sep 17 00:00:00 2001 From: Rokojori Date: Mon, 13 Jul 2026 14:45:19 +0200 Subject: [PATCH] auth: add GET /api/auth/logout?redirect= for browser-based logout links MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Mirrors the refresh-session pattern — clears cookies, invalidates refresh token, and redirects to the given URL (falls back to /login.html). Co-Authored-By: Claude Sonnet 4.6 --- source/server/routes/auth.ts | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/source/server/routes/auth.ts b/source/server/routes/auth.ts index e968035..2588c0e 100644 --- a/source/server/routes/auth.ts +++ b/source/server/routes/auth.ts @@ -137,6 +137,16 @@ router.post( '/logout', ( req, res ) => res.json( { ok: true } ); } ); +// GET /api/auth/logout?redirect=... — browser clients (link/redirect-based logout) +router.get( '/logout', ( req, res ) => +{ + const redirectTo = req.query.redirect as string | undefined; + const token = req.cookies?.refreshToken as string | undefined; + if ( token ) refreshTokens.delete( token ); + clearAuthCookies( res ); + res.redirect( redirectTo ?? '/login.html' ); +} ); + // POST /api/auth/refresh — non-browser clients (token in body) router.post( '/refresh', ( req, res ) => {