Logging out of flask app - end session endpoint

[jhudsy]

The "/logout" route seems to be hard coded in identity.flask and redirects to url_root. However, in web.py there seems to be an option to redirect to other routes via log_out to a homepage. Could identity.flask add something to logout to allow for different end session endpoints? I'd like to clear some other elements of my session before doing a full logout, and it seems very convoluted to do so in the current state.

All the best,
Nir

[rayluo]

(UPDATED in Apr 21, 2025)

There are two ways to solve this.

1. After from identity.flask import Auth, you can try subclass Auth and override its def logout(self) method. Add your own clear-session logic there, while still calling the parent method and return its return value.
2. Since the new Identity 0.10.0, you can now configure the logout to end at your own post-logout page, so, you can not only add your session clear logic there, but also customize the appearance of the logout experience.

[jhudsy]

Thanks. In case anyone in the future ends up finding this discussion, here is the code I settled on to get things working as per @rayluo's suggestion.

from typing import Optional
from flask import Flask
import identity.flask
from urllib.parse import urlparse

class Auth(identity.flask.Auth):
    def __init__(self, app: Optional[Flask], *args, **kwargs):
        self._post_logout_uri = kwargs.get('post_logout_uri', None)
        new_kwargs = {k:v for k,v in kwargs.items() if k!="post_logout_uri"}
        super().__init__(app, *args, **new_kwargs)

    def logout(self):
        if self._post_logout_uri is None:
            self._post_logout_uri = self._request.host_url
        else:
            parsed_uri = urlparse(self._post_logout_uri)
            self._post_logout_uri = self._post_logout_uri if parsed_uri.hostname!= None else urlparse(self._request.host_url+self._post_logout_uri).geturl()
        return self.__class__._redirect(self._auth.log_out(self._post_logout_uri))

Note that _post_logout_uri should be an absolute uri for things to work; if it's relative then the code above converts it to an absolute uri.

My app.py now has the lines

auth = Auth(app,
            authority="https://login.microsoftonline.com/"+app.config['OIDC_TENANT_ID'],
            client_id=app.config['OIDC_CLIENT_ID'],
            client_credential=app.config['OIDC_CLIENT_SECRET'],
            redirect_uri=app.config['OIDC_REDIRECT_URI'],
            post_logout_uri="/finalize_logout"
)
...
@app.route('/finalize_logout')
def finalize_logout():
    session.clear()
    return "You have been logged out."

And everything seems to work :)

Thanks again to @rayluo for the advice.

[jhudsy]

@rayluo No luck yet. I've added some logging to your code and while self._post_logout_view is set correctly, the post_logout_redirect_uri in web.py's log_out method seems to always default to the hostname. In fact, the logout method in flask.py and/or pallet.py don't seem to be invoked..

Nir

[rayluo]

Thanks for trying. I tried it in my own sample, plus performed a self code review, but could not find any issue. Do you think you can share with me a minimalist yet full demo web app to reproduce the issue? For example, here comes mine. Note that the logout page has to be define after app = Flask(...) yet before auth = Auth(...) (in fact, there is no way to define it elsewhere, so it should be hard to go wrong).

from identity.flask import Auth
import app_config

app = Flask(__name__)
app.config.from_object(app_config)

@app.route("/goodbye")
def bye():
    return "good bye"

auth = Auth(
    app,
    authority=os.getenv("AUTHORITY"),
    client_id=os.getenv("CLIENT_ID"),
    client_credential=os.getenv("CLIENT_SECRET"),
    redirect_uri=os.getenv("REDIRECT_URI"),
    oidc_authority=os.getenv("OIDC_AUTHORITY"),
    ...,
    post_logout_view=bye,
)

@app.route("/")
@auth.login_required
def index(*, context):
    return render_template(
        'index.html',
        ...
    )

[rayluo]

I expand the latest code snippet above into a completed sample. @jhudsy you can take a look at the new implementation. The full sample is currently in this experimental branch.

[jhudsy]

@rayluo , I owe you a massive apology. I had not noticed (until working trying to create a minimal example as requested), that I was still importing my own modified version of Auth which is what was causing the errors. I have just tested with your modified code, and it works perfectly.

Thanks, and apologies again!

[rayluo]

The messing up dev environment is an issue we all occasionally run into. Glad that you figured it out eventually.

I shall also thank you, @jhudsy , for your willingness to get back to me with the confirmation. Now I can merge in #50 with confidence, and I'll ship a new 0.10.0 version soon. Together we help the world to have a better auth library. :-)