revert changes to sign-out

MozillaSocial · Feb 28, 2024 · 4d68c43 · 4d68c43
1 parent 27cae40
commit 4d68c43
Show file tree

Hide file tree

Showing 2 changed files with 5 additions and 4 deletions.
diff --git a/app/controllers/application_controller.rb b/app/controllers/application_controller.rb
@@ -87,7 +87,11 @@ def skip_csrf_meta_tags?
   end
 
   def after_sign_out_path_for(_resource_or_scope)
-    root_path
+    if ENV['OMNIAUTH_ONLY'] == 'true' && ENV['OIDC_ENABLED'] == 'true'
+      '/auth/auth/openid_connect/logout'
+    else
+      new_user_session_path
+    end
   end
 
   protected

diff --git a/app/controllers/auth/sessions_controller.rb b/app/controllers/auth/sessions_controller.rb
@@ -11,9 +11,6 @@ class Auth::SessionsController < Devise::SessionsController
   skip_before_action :require_functional!
   skip_before_action :update_user_sign_in
 
-  # Allow any client to call /auth/sign_out via a delete call
-  skip_before_action :verify_authenticity_token, only: [:destroy]
-
   prepend_before_action :check_suspicious!, only: [:create]
 
   include TwoFactorAuthenticationConcern