Rokojori
/
rokojori-auth
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

auth: add GET /api/auth/logout?redirect= for browser-based logout links 

Mirrors the refresh-session pattern — clears cookies, invalidates refresh
token, and redirects to the given URL (falls back to /login.html).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
Rokojori 2026-07-13 14:45:19 +02:00
parent 61f15e1325
commit 7ed9b9d7a2
1 changed files with 10 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
source/server/routes/auth.ts
View File

@ -137,6 +137,16 @@ router.post( '/logout', ( req, res ) =>
res.json( { ok: true } );
} );
// GET /api/auth/logout?redirect=... — browser clients (link/redirect-based logout)
router.get( '/logout', ( req, res ) =>
{
const redirectTo = req.query.redirect as string | undefined;
const token = req.cookies?.refreshToken as string | undefined;
if ( token ) refreshTokens.delete( token );
clearAuthCookies( res );
res.redirect( redirectTo ?? '/login.html' );
} );
// POST /api/auth/refresh — non-browser clients (token in body)
router.post( '/refresh', ( req, res ) =>
{