litellm/ui/litellm-dashboard/src
Oliver Jensen bc3b5b1d5b
fix(proxy): revoke UI session tokens on logout and password change (#42463)
* fix(proxy): revoke UI session tokens on logout and password change

Adds POST /session/logout to revoke the presented UI session key server
side (previously logout was client-side only and the key stayed valid
until expiry). Password changes now revoke the user's other UI sessions:
self-change keeps the caller's session, admin reset and onboarding claim
revoke all. The BYOK OAuth cookie auth now re-resolves the embedded key
against the DB so revoked sessions get a 401.

* fix(proxy): satisfy B008 budget and backend allowlist for /session/logout

* refactor(proxy): satisfy type-discipline budget in session_endpoints
2026-09-23 10:31:38 +02:00
..
app fix(proxy): revoke UI session tokens on logout and password change (#42463) 2026-09-23 10:31:38 +02:00
components fix(proxy): revoke UI session tokens on logout and password change (#42463) 2026-09-23 10:31:38 +02:00
contexts feat(auth): breached password detection, self-service change-password and forced password reset 2026-09-21 18:48:35 +00:00
data feat(ui): shadcn migration foundation: Tailwind v4, shadcn init, antd cascade fix (#31995) 2026-07-02 19:02:27 -07:00
hooks feat(ui): shared URL-state layer for tables and tabs 2026-09-16 15:51:45 -07:00
lib fix(proxy): revoke UI session tokens on logout and password change (#42463) 2026-09-23 10:31:38 +02:00
utils Merge remote-tracking branch 'origin/main' into litellm_upgrade_banner_changelog_stats 2026-09-19 00:04:07 +00:00
types.ts added and ran prettier autoformatter 2025-10-04 18:19:48 -07:00