Skip to content

v0.30.1

Release Date: 2026-11-02

A security fix for signing out of an app:

  • Signing out ends the SystemAuth login session too. POST /bff/auth/logout ended the app's session and revoked its tokens, but the SystemAuth login session stayed. The app's next sign-in resumed it without asking, so a person who signed out, for example on a shared computer, was signed straight back in. A client that sends Accept: application/json now gets a 200 naming SystemAuth's sign-out page and where to return; it submits a form there, and SystemAuth ends its login session, revokes the person's tokens and ends their sessions in the other apps through the back-channel logout. @plexusone/auth 0.2.2 does this.

It adds no breaking change. A client that does not ask for JSON still gets the 204.

Upgrade notes

  1. Update the web client to @plexusone/auth 0.2.2 or later, which asks for JSON and goes to SystemAuth's sign-out page.
  2. Check social_login.allowed_redirect_origins lists each app's origin: SystemAuth accepts the sign-out form only from those origins and returns only to them.
  3. The app and SystemAuth must share a site (registrable domain), such as app.example.com and auth.example.com: the login cookie is SameSite=Lax, so a browser does not send it on a cross-site POST.
  4. BFFConfig.SignOutURL is SystemAuth's sign-out page, the issuer's /logout by default. Set it to - to keep the 204 for every client.

See Relying party.