浏览代码

Fixed an issue with clearing application cookies during OAuth signout

Closes #8885.

During the OAuth signout flow, although the `token` and `oauth_id_token`
cookies were marked for deletion, a new RedirectResponse is created and
returned. This does not contain the header info from the he Response object
used to mark the cookies to be deleted. Hence the cookies remained.
Fixed this by re-using the headers from the other Response object.
Ranjan Mohan 2 月之前
父节点
当前提交
6c6be5de88
共有 1 个文件被更改,包括 1 次插入0 次删除
  1. 1 0
      backend/open_webui/routers/auths.py

+ 1 - 0
backend/open_webui/routers/auths.py

@@ -546,6 +546,7 @@ async def signout(request: Request, response: Response):
                             if logout_url:
                                 response.delete_cookie("oauth_id_token")
                                 return RedirectResponse(
+                                    headers=response.headers,
                                     url=f"{logout_url}?id_token_hint={oauth_id_token}"
                                 )
                         else: