Clear NextAuth session during logout #146

New issue

Closed

opened 2026-08-06 22:18:31 +00:00 by aaperis · 0 comments

aaperis commented

2026-08-06 22:18:31 +00:00

(Migrated from github.com)

This should be taken care of after #104 is done (or in #104).

Please describe the feature

As a user,
I want logout to clear both the SDAD token session and the authentication session
so that
my tokens and login state are removed from this device.

Detailed description

This is a follow-up to #11.

The current logout implementation from #145 clears the custom SDA session cookie (sdad-session) and redirects the user away from the authenticated UI. However, NextAuth still keeps its own session cookies on the device.

Extend the logout flow so that signing out clears both:

the custom SDA Download UI session/token state
the NextAuth session/cookies used by the OIDC login flow

Acceptance criteria

Functionality implemented in #145 is preserved.
Logout also clears the NextAuth session cookies.
Add tests to cover clearing the NextAuth session state.

Additional context

The implementation for this can build upon the existing logout() flow rather than replacing it.
See the related issue #104.

This should be taken care of after #104 is done (or in #104). ## Please describe the feature As a user, I want logout to clear both the SDAD token session and the authentication session so that my tokens and login state are removed from this device. ## Detailed description This is a follow-up to #11. The current logout implementation from #145 clears the custom SDA session cookie (`sdad-session`) and redirects the user away from the authenticated UI. However, NextAuth still keeps its own session cookies on the device. Extend the logout flow so that signing out clears both: - the custom SDA Download UI session/token state - the NextAuth session/cookies used by the OIDC login flow #### Acceptance criteria - Functionality implemented in #145 is preserved. - [ ] Logout also clears the NextAuth session cookies. - [ ] Add tests to cover clearing the NextAuth session state. ## Additional context - The implementation for this can build upon the existing `logout()` flow rather than replacing it. - See the related issue #104.