fix(auth): every sign-in forces re-authentication (prompt=login, max_age=0) #209

2026-11-09T20:43:06Z

james.maes commented

2026-11-09 20:43:06 +00:00

Finding: web Sign out is correct (auth-provider.tsx handleLogout: apiLogout, clear client data, then window.location.assign(end_session_endpoint?client_id&post_logout_redirect_uri=origin/login)). But buildAuthorizationUrl sent neither prompt nor max_age, so any provider session that survived (e.g. the provider's invalidation flow ending only the app session, which is the Forge Authentik setup fixed in greater-goods-authentik-cd PR 26) silently re-authenticated the next login. Now OAUTH2 and AUTH_0 sign-ins send prompt=login and max_age=0.

Tests: oidc.test.ts updated plus a new case; fail before (2 failed), pass after (src/lib/auth: 80 passed). pnpm lint: 0 errors. Full pnpm test: 3802 passed, 3 failed + 4 files failing to load (zod 'error' option / pdf / typescript worker modules in this local install); those are not auth-related and fail identically without this change. pnpm typecheck has 24 pre-existing zod-related errors on main. Playwright acceptance not run locally.

Release: needs a new qqq-frontend-next RC from main, then bump qqq-frontend-next.version in gg-forge pom.xml (currently 1.0.0-RC.38). Do not tag from this PR.

Finding: web Sign out is correct (auth-provider.tsx handleLogout: apiLogout, clear client data, then window.location.assign(end_session_endpoint?client_id&post_logout_redirect_uri=origin/login)). But buildAuthorizationUrl sent neither prompt nor max_age, so any provider session that survived (e.g. the provider's invalidation flow ending only the app session, which is the Forge Authentik setup fixed in greater-goods-authentik-cd PR 26) silently re-authenticated the next login. Now OAUTH2 and AUTH_0 sign-ins send prompt=login and max_age=0. Tests: oidc.test.ts updated plus a new case; fail before (2 failed), pass after (src/lib/auth: 80 passed). pnpm lint: 0 errors. Full pnpm test: 3802 passed, 3 failed + 4 files failing to load (zod 'error' option / pdf / typescript worker modules in this local install); those are not auth-related and fail identically without this change. pnpm typecheck has 24 pre-existing zod-related errors on main. Playwright acceptance not run locally. Release: needs a new qqq-frontend-next RC from main, then bump qqq-frontend-next.version in gg-forge pom.xml (currently 1.0.0-RC.38). Do not tag from this PR.

james.maes added 1 commit 2026-11-09 20:43:06 +00:00

fix(auth): every sign-in forces re-authentication (prompt=login, max_age=0)

maven / build (push) Successful in 7m37s

Details

build / maven (push) Successful in 7m37s

Details

c0e5b285db

Sign out already ends the provider session (RP-initiated logout); the authorize
request now also sends prompt=login and max_age=0 so a lingering provider
session can never sign the next user in silently. prompt=login alone was seen
reusing retained SSO on real Authentik.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

james.maes merged commit fefd5be0d4 into main

2026-11-09 20:59:20 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: QRun-IO/qqq-frontend-next#209