agora inbox for pgsql-www@postgresql.org
help / color / mirror / Atom feedBug during logout
6+ messages / 3 participants
[nested] [flat]
* Bug during logout
@ 2026-08-10 09:36 Jonathan Gonzalez V. <jonathan@abdiel.eu>
2026-08-11 06:50 ` Re: Bug during logout Álvaro Herrera <alvherre@kurilemu.de>
0 siblings, 1 reply; 6+ messages in thread
From: Jonathan Gonzalez V. @ 2026-08-10 09:36 UTC (permalink / raw)
To: pgsql-www
Hello!!
Yesterday Jonathan S. Katz solved my issue with my account unlinking the
OAuth, with that I find out that the logout link isn't working because I
get a 405 when I click on it and I still logged in.
The following patch fix that issue, by adding the post method to the
pgweb/util/contexts.py and templates/base/page.html.
Django deprecated the GET method for the logout in 4.1[0] so mostly
probably this was a leftover of a migration. Giving that this could
happen again, I've added a test for that too.
Also, there's a change in the CSS that makes the button inside the form
to look like a link.
Regards!!
[0] https://docs.djangoproject.com/en/dev/releases/4.1/#log-out-via-get
--
Jonathan Gonzalez V.
EDB https://www.enterprisedb.com
Attachments:
[text/x-diff] 0001-Turn-the-logout-link-into-a-POST-method-following-Dj.patch (0B, ../../874ih29v24.fsf@abdiel.eu/2-0001-Turn-the-logout-link-into-a-POST-method-following-Dj.patch)
download
^ permalink raw reply [nested|flat] 6+ messages in thread
* Re: Bug during logout
2026-08-10 09:36 Bug during logout Jonathan Gonzalez V. <jonathan@abdiel.eu>
@ 2026-08-11 06:50 ` Álvaro Herrera <alvherre@kurilemu.de>
2026-08-11 07:50 ` Re: Bug during logout Jonathan Gonzalez V. <jonathan@abdiel.eu>
0 siblings, 1 reply; 6+ messages in thread
From: Álvaro Herrera @ 2026-08-11 06:50 UTC (permalink / raw)
To: Jonathan Gonzalez V. <jonathan@abdiel.eu>; +Cc: pgsql-www
Hi,
On 2026-Aug-10, Jonathan Gonzalez V. wrote:
> Django deprecated the GET method for the logout in 4.1[0] so mostly
> probably this was a leftover of a migration.
Ah yeah, they removed support for GET logouts in Django 5.0 apparently:
Support for logging out via GET requests in the
django.contrib.auth.views.LogoutView and
django.contrib.auth.views.logout_then_login() is removed.
https://docs.djangoproject.com/en/dev/releases/5.0/
--
Álvaro Herrera 48°01'N 7°57'E — https://www.EnterpriseDB.com/
"Entristecido, Wutra (canción de Las Barreras)
echa a Freyr a rodar
y a nosotros al mar"
^ permalink raw reply [nested|flat] 6+ messages in thread
* Re: Bug during logout
2026-08-10 09:36 Bug during logout Jonathan Gonzalez V. <jonathan@abdiel.eu>
2026-08-11 06:50 ` Re: Bug during logout Álvaro Herrera <alvherre@kurilemu.de>
@ 2026-08-11 07:50 ` Jonathan Gonzalez V. <jonathan@abdiel.eu>
2026-08-11 08:14 ` Re: Bug during logout Magnus Hagander <magnus@hagander.net>
0 siblings, 1 reply; 6+ messages in thread
From: Jonathan Gonzalez V. @ 2026-08-11 07:50 UTC (permalink / raw)
To: Álvaro Herrera <alvherre@kurilemu.de>; +Cc: pgsql-www
Hi!
Álvaro Herrera <alvherre@kurilemu.de> writes:
> Hi,
>
> On 2026-Aug-10, Jonathan Gonzalez V. wrote:
>
>> Django deprecated the GET method for the logout in 4.1[0] so mostly
>> probably this was a leftover of a migration.
>
> Ah yeah, they removed support for GET logouts in Django 5.0 apparently:
>
> Support for logging out via GET requests in the
> django.contrib.auth.views.LogoutView and
> django.contrib.auth.views.logout_then_login() is removed.
> https://docs.djangoproject.com/en/dev/releases/5.0/
Ho! with that in mind I tracked the issue to this commit
https://git.postgresql.org/gitweb/?p=pgweb.git;a=commitdiff;h=f09775acb2b3edac131e1de7863108c517262a...
so it has been there for not so long, good thing, looks like people
doesn't like to logout of postgresql.org :D
Regards
--
Jonathan Gonzalez V.
EDB https://www.enterprisedb.com
^ permalink raw reply [nested|flat] 6+ messages in thread
* Re: Bug during logout
2026-08-10 09:36 Bug during logout Jonathan Gonzalez V. <jonathan@abdiel.eu>
2026-08-11 06:50 ` Re: Bug during logout Álvaro Herrera <alvherre@kurilemu.de>
2026-08-11 07:50 ` Re: Bug during logout Jonathan Gonzalez V. <jonathan@abdiel.eu>
@ 2026-08-11 08:14 ` Magnus Hagander <magnus@hagander.net>
2026-08-18 09:21 ` Re: Bug during logout Magnus Hagander <magnus@hagander.net>
0 siblings, 1 reply; 6+ messages in thread
From: Magnus Hagander @ 2026-08-11 08:14 UTC (permalink / raw)
To: Jonathan Gonzalez V. <jonathan@abdiel.eu>; +Cc: Álvaro Herrera <alvherre@kurilemu.de>; pgsql-www
On Tue, 11 Aug 2026 at 09:50, Jonathan Gonzalez V. <jonathan@abdiel.eu>
wrote:
> Hi!
>
> Álvaro Herrera <alvherre@kurilemu.de> writes:
> > Hi,
> >
> > On 2026-Aug-10, Jonathan Gonzalez V. wrote:
> >
> >> Django deprecated the GET method for the logout in 4.1[0] so mostly
> >> probably this was a leftover of a migration.
> >
> > Ah yeah, they removed support for GET logouts in Django 5.0 apparently:
> >
> > Support for logging out via GET requests in the
> > django.contrib.auth.views.LogoutView and
> > django.contrib.auth.views.logout_then_login() is removed.
> > https://docs.djangoproject.com/en/dev/releases/5.0/
>
> Ho! with that in mind I tracked the issue to this commit
>
> https://git.postgresql.org/gitweb/?p=pgweb.git;a=commitdiff;h=f09775acb2b3edac131e1de7863108c517262a...
> so it has been there for not so long, good thing, looks like people
> doesn't like to logout of postgresql.org :D
>
>
Yeah, I'm surprised it went this far before someone noticed.
So a few things on the patch:
1. This would be the *only* test in the codebase :) I think fixing that
scenario should be kept to a separate patch - it clearly would be good to
have them, buth aving *one* makes not much sense. Also, what's up with
enabling ESI on the tests -- then you require Varnish to run the tests
properly.
2. It seems you assign a "post" variable to the sitenav structure, whichi s
then never used because you instead hardcode the URL in the template? (FWIW
I do think using the variable is the right thing, but then it should be
used)
3. This does not cover the case of "distributed logout". That is, there are
GET links in the community auth system that does the same. If we actually
care about not being able to log out that way, we'd need to fix that too?
//Magnus
^ permalink raw reply [nested|flat] 6+ messages in thread
* Re: Bug during logout
2026-08-10 09:36 Bug during logout Jonathan Gonzalez V. <jonathan@abdiel.eu>
2026-08-11 06:50 ` Re: Bug during logout Álvaro Herrera <alvherre@kurilemu.de>
2026-08-11 07:50 ` Re: Bug during logout Jonathan Gonzalez V. <jonathan@abdiel.eu>
2026-08-11 08:14 ` Re: Bug during logout Magnus Hagander <magnus@hagander.net>
@ 2026-08-18 09:21 ` Magnus Hagander <magnus@hagander.net>
2026-08-18 10:49 ` Re: Bug during logout Jonathan Gonzalez V. <jonathan@abdiel.eu>
0 siblings, 1 reply; 6+ messages in thread
From: Magnus Hagander @ 2026-08-18 09:21 UTC (permalink / raw)
To: Jonathan Gonzalez V. <jonathan@abdiel.eu>; +Cc: Álvaro Herrera <alvherre@kurilemu.de>; pgsql-www
On Tue, 11 Aug 2026 at 11:30, Jonathan Gonzalez V. <jonathan@abdiel.eu>
wrote:
>
> Hello!
>
> Magnus Hagander <magnus@hagander.net> writes:
> > So a few things on the patch:
> >
> > 1. This would be the *only* test in the codebase :) I think fixing that
> scenario should be kept to a separate patch - it clearly
> > would be good to have them, buth aving *one* makes not much sense. Also,
> what's up with enabling ESI on the tests -- then
> > you require Varnish to run the tests properly.
>
> Well, having the first test it's the starting point, and patch should
> always carry their own when is possible, this helps to avoid making the
> same mistake in the future. Well, having *one* tests it's the starting
> point, nothing make sense without the first one right? About the ESI,
> yeah if you run the tests with a Varnish in front to test the full
> infrastructure it will make sense, but clearly not the case, I remove it.
>
I think most people don't have varnish in their dev env, but I might be
wrong :)
> 2. It seems you assign a "post" variable to the sitenav structure, whichi
> s then never used because you instead hardcode the
> > URL in the template? (FWIW I do think using the variable is the right
> thing, but then it should be used)
>
> Yeah! It was in between the work I was doing and forgot the change, yeah
> the idea is that any thing that it's a post go with a form, but, later
> my thought was "ok the logout", so, there will be anything else except
> the logout that it's going to be a post? anyway, yes I changed it!
>
> > 3. This does not cover the case of "distributed logout". That is, there
> are GET links in the community auth system that does the
> > same. If we actually care about not being able to log out that way, we'd
> need to fix that too?
>
> Uhmm, when you mean "distributed logout", you mean when people use the
> OAuth capabilities provided by postgresql.org right? Well, I think that
>
It's not OAuth, it's a custom protocol, but yes, that.
> logging out from a website it goes in the website, but if we want to
> have a logout control it should be in the panel that mange the session
> of the PostgreSQL OAuth system, so that panel should have the session
> per site, and from there it should logout other systems, so the webpage
> logout only that, the webpage.
>
Actually, I looked at it a bit, and the distributed logout actually uses a
different endpoint. But we might want to look into that one as well :)
But now I'm curious, there's any panel that manage the session in other
> sites like 2026.pgconf.eu, etc ? In that case, probably we can do
> something on that side in another patch!
>
>
Yes, for example https://www.postgresql.eu/account/ has a logout in
bottom-left as well.
//Magnus
^ permalink raw reply [nested|flat] 6+ messages in thread
* Re: Bug during logout
2026-08-10 09:36 Bug during logout Jonathan Gonzalez V. <jonathan@abdiel.eu>
2026-08-11 06:50 ` Re: Bug during logout Álvaro Herrera <alvherre@kurilemu.de>
2026-08-11 07:50 ` Re: Bug during logout Jonathan Gonzalez V. <jonathan@abdiel.eu>
2026-08-11 08:14 ` Re: Bug during logout Magnus Hagander <magnus@hagander.net>
2026-08-18 09:21 ` Re: Bug during logout Magnus Hagander <magnus@hagander.net>
@ 2026-08-18 10:49 ` Jonathan Gonzalez V. <jonathan@abdiel.eu>
0 siblings, 0 replies; 6+ messages in thread
From: Jonathan Gonzalez V. @ 2026-08-18 10:49 UTC (permalink / raw)
To: Magnus Hagander <magnus@hagander.net>; +Cc: Álvaro Herrera <alvherre@kurilemu.de>; pgsql-www
Hi!
Magnus Hagander <magnus@hagander.net> writes:
> ...
>
> logging out from a website it goes in the website, but if we want to
> have a logout control it should be in the panel that mange the session
> of the PostgreSQL OAuth system, so that panel should have the session
> per site, and from there it should logout other systems, so the webpage
> logout only that, the webpage.
>
> Actually, I looked at it a bit, and the distributed logout actually uses a different endpoint. But we might want to look into that
> one as well :)
Interesting, which one? I'm guessing you mean `accounts/logout` which
has an additional `s`.
> But now I'm curious, there's any panel that manage the session in other
> sites like 2026.pgconf.eu, etc ? In that case, probably we can do
> something on that side in another patch!
>
> Yes, for example https://www.postgresql.eu/account/ has a logout in bottom-left as well.
Well, this one didn't logged me out from postgresql.org, so I it's not
like a "log me out of everything" or "close my session on this site" I
was thinking more in something that show you all the sites that you're
authenticated, but I think that that it's another issue.
Regards,
--
Jonathan Gonzalez V.
EDB
https://www.enterprisedb.com
^ permalink raw reply [nested|flat] 6+ messages in thread
end of thread, other threads:[~2026-08-18 10:49 UTC | newest]
Thread overview: 6+ messages (download: mbox mbox.gz follow: Atom feed)
-- links below jump to the message on this page --
2026-08-10 09:36 Bug during logout Jonathan Gonzalez V. <jonathan@abdiel.eu>
2026-08-11 06:50 ` Álvaro Herrera <alvherre@kurilemu.de>
2026-08-11 07:50 ` Jonathan Gonzalez V. <jonathan@abdiel.eu>
2026-08-11 08:14 ` Magnus Hagander <magnus@hagander.net>
2026-08-18 09:21 ` Magnus Hagander <magnus@hagander.net>
2026-08-18 10:49 ` Jonathan Gonzalez V. <jonathan@abdiel.eu>
This inbox is served by agora; see mirroring instructions
for how to clone and mirror all data and code used for this inbox