From d3353bdb1dbc7623688ebf7bf7048cdaf07092cd Mon Sep 17 00:00:00 2001 From: teddiesloco Date: Thu, 27 Aug 2026 18:55:36 +0700 Subject: [PATCH] fix(auth): suppress OAUTH_AUTO_REDIRECT on signout navigation to prevent logout redirect loop (#29076) --- src/lib/components/layout/Sidebar/UserMenu.svelte | 2 +- src/routes/auth/+page.svelte | 5 +++-- 2 files changed, 4 insertions(+), 3 deletions(-) diff --git a/src/lib/components/layout/Sidebar/UserMenu.svelte b/src/lib/components/layout/Sidebar/UserMenu.svelte index 8c1d4a0042..53fbf6ea80 100644 --- a/src/lib/components/layout/Sidebar/UserMenu.svelte +++ b/src/lib/components/layout/Sidebar/UserMenu.svelte @@ -574,7 +574,7 @@ user.set(null); localStorage.removeItem('token'); - location.href = res?.redirect_url ?? '/auth'; + location.href = res?.redirect_url ?? '/auth?signout=true'; show = false; }} > diff --git a/src/routes/auth/+page.svelte b/src/routes/auth/+page.svelte index 0dc9439b04..1bb12e85c3 100644 --- a/src/routes/auth/+page.svelte +++ b/src/routes/auth/+page.svelte @@ -173,9 +173,10 @@ // Auto-redirect to SSO when OAUTH_AUTO_REDIRECT is enabled and the // deployment is unambiguously SSO-only (single provider, no login form, - // no LDAP). Suppressed by ?form=, ?error=, onboarding, trusted-header + // no LDAP). Suppressed by ?form=, ?error=, ?signout, onboarding, trusted-header // auth, or an existing session/token. - if ($config?.oauth?.auto_redirect && !form && !error) { + const signout = $page.url.searchParams.get('signout'); + if ($config?.oauth?.auto_redirect && !form && !error && !signout) { const providers = Object.keys($config?.oauth?.providers ?? {}); if ( providers.length === 1 &&