Log the user out of One Login when their form is submitted#2070
Merged
stephencdaly merged 4 commits intomainfrom Apr 29, 2026
Merged
Log the user out of One Login when their form is submitted#2070stephencdaly merged 4 commits intomainfrom
stephencdaly merged 4 commits intomainfrom
Conversation
stephencdaly
force-pushed
the
log-user-out-when-they-submit
branch
5 times, most recently
from
8461b02 to
8cf9a2d
Compare
stephencdaly
force-pushed
the
log-user-out-when-they-submit
branch
3 times, most recently
from
50b1c1c to
00e0590
Compare
Store the auth token returned by One Login in the session so we can use it to log the user out when they submit their form.
If the user has an active session with One Login, redirect the user to the One Login logout URL when they submit their form. We provide a token and a post logout redirect URL to receive the user back after they've been logged out. Store the form path params on the session before redirecting. We will have already stored these before they logged in with One Login, but we set them again in case they were also filling out another form in a different browser tab.
When One Login redirects the user back to us after logging out, retrieve the form path parameters from the session to redirect to the submitted page. If the user's session cookie has been lost and we're unable to determine the form path parameters, let an exception bubble up and show an internal error page for now. We'll probably update this to show something more user friendly in a future commit.
This avoids having to keep track of the multiple store classes we now have in the controllers, and removes some logic from the controllers. Hopefully this makes it a bit easier to see what's involved in the auth process.
stephencdaly
force-pushed
the
log-user-out-when-they-submit
branch
from
00e0590 to
cb1c4a1
Compare
Contributor
|
🎉 A review copy of this PR has been deployed! You can reach it at: https://pr-2070.submit.review.forms.service.gov.uk/ It may take 5 minutes or so for the application to be fully deployed and working. If it still isn't ready For the sign in details and more information, see the review apps wiki page. |
DavidBiddle
approved these changes
Apr 29, 2026
Contributor
DavidBiddle
left a comment
DavidBiddle
left a comment
There was a problem hiding this comment.
Code looks good and the logout works for me locally 🎉
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What problem does this pull request solve?
Trello card: https://trello.com/c/tKtA1VPQ/2858-create-integration-with-one-login
As per the One Login technical documentation, we should build functionality to log the user out to prevent risk of users accidentally sharing sessions. The docs say this can be done by coding the submit button to automatically log the user out.
Handle logging the user out by:
If the user's session cookie has been lost and we're unable to determine the form path parameters after they've been returned to us, let an exception bubble up and show an internal error page for now. We're currently discussing whether we can show something more friendly to the user.
Local testing
Add
http://localhost:3001/auth/logged-outto thePost logout redirect URIs (optional)in the one login admin toolTo see that it's logged you out, you can complete a form and log in with One Login. After submitting, try to complete another form and you should be asked to log in again if you want a copy of your answers.
Things to consider when reviewing