Harsh Satyajit Thakur e67dd4c818 fix: skip OIDC end-session after password login for OAuth2 users (#38439) ...

Fixes #38209

OAuth2-linked accounts that sign in via the password form were still
redirected to the provider end_session_endpoint on logout because the
redirect was keyed off account LoginType.

Store the session sign-in method (password vs oauth2) and only use
RP-initiated OIDC logout when this session was authenticated via OAuth2.
Sessions without the new key keep the previous LoginType behavior.

---------

Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>

2026-07-27 15:35:48 +00:00

..

2fa.go

fix: Various security fixes (#38103)

2026-06-17 16:06:51 +00:00

auth_test.go

fix: skip OIDC end-session after password login for OAuth2 users (#38439)

2026-07-27 15:35:48 +00:00

auth.go

fix: skip OIDC end-session after password login for OAuth2 users (#38439)

2026-07-27 15:35:48 +00:00

linkaccount.go

fix: skip OIDC end-session after password login for OAuth2 users (#38439)

2026-07-27 15:35:48 +00:00

main_test.go

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873)

2026-05-26 15:49:31 -07:00

oauth2_provider.go

fix(oauth2): enforce mandatory 2FA policy on OAuth2 authorize/grant endpoints (#38591)

2026-07-24 01:39:38 +00:00

oauth_signin_sync.go

fix(oauth2): not respecting claims before second login (#37874)

2026-06-03 16:50:47 +00:00

oauth_test.go

fix: various security fixes (#38406)

2026-07-12 17:14:09 +00:00

oauth.go

fix: skip OIDC end-session after password login for OAuth2 users (#38439)

2026-07-27 15:35:48 +00:00

openid.go

feat: admin impersonates a user (#38614)

2026-07-26 17:26:02 +00:00

password.go

fix: Various security fixes (#38103)

2026-06-17 16:06:51 +00:00

webauthn.go

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873)

2026-05-26 15:49:31 -07:00