Files
gitea/modules
Harsh Satyajit Thakur e67dd4c818 fix: skip OIDC end-session after password login for OAuth2 users (#38439)
Fixes #38209

OAuth2-linked accounts that sign in via the password form were still
redirected to the provider end_session_endpoint on logout because the
redirect was keyed off account LoginType.

Store the session sign-in method (password vs oauth2) and only use
RP-initiated OIDC logout when this session was authenticated via OAuth2.
Sessions without the new key keep the previous LoginType behavior.

---------

Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
2026-07-27 15:35:48 +00:00
..
2026-07-12 17:14:09 +00:00
2026-07-26 16:57:00 +00:00
2026-07-12 17:14:09 +00:00