cozystack

0 Fork 0

mirror of https://github.com/cozystack/cozystack.git synced 2026-11-03 10:37:21 +09:00

Files

T

History

IvanHunters 99936a92f8 fix(dashboard): stop requesting offline_access so logout can revoke sessions

The dashboard auth-proxy (oauth2-proxy) requested the offline_access scope,
so Keycloak issued an offline refresh token. oauth2-proxy stores that token
in the kc-access cookie (no server-side session store) and silently refreshes
it, and an offline token is decoupled from the SSO session: logout
(end_session) does not revoke it. A copied cookie therefore stayed usable for
the whole offline-session lifetime even after the user logged out.

Drop offline_access from the proxy --scope so Keycloak issues an online
refresh token bound to the SSO session, which logout revokes. Also remove the
offline_access optional client scope for cleanliness.

Signed-off-by: IvanHunters <xorokhotnikov@gmail.com>

2026-07-24 14:19:18 +03:00

images

chore(deps): update container image & action digests

2026-07-10 05:29:23 +00:00

templates

fix(dashboard): stop requesting offline_access so logout can revoke sessions

2026-07-24 14:19:18 +03:00

tests

fix(platform): route OIDC backend calls through the in-cluster Keycloak by default

2026-07-14 14:22:46 +03:00

.gitignore

build(dashboard): vendor cozystack-ui console in-tree