{"action":"created","issue":{"url":"https://api.github.com/repos/yourlabs/django-session-security/issues/93","repository_url":"https://api.github.com/repos/yourlabs/django-session-security","labels_url":"https://api.github.com/repos/yourlabs/django-session-security/issues/93/labels{/name}","comments_url":"https://api.github.com/repos/yourlabs/django-session-security/issues/93/comments","events_url":"https://api.github.com/repos/yourlabs/django-session-security/issues/93/events","html_url":"https://github.com/yourlabs/django-session-security/issues/93","id":215596372,"number":93,"title":"Post-logout redirect never fires","user":{"login":"shacker","id":102694,"avatar_url":"https://avatars2.githubusercontent.com/u/102694?v=4","gravatar_id":"","url":"https://api.github.com/users/shacker","html_url":"https://github.com/shacker","followers_url":"https://api.github.com/users/shacker/followers","following_url":"https://api.github.com/users/shacker/following{/other_user}","gists_url":"https://api.github.com/users/shacker/gists{/gist_id}","starred_url":"https://api.github.com/users/shacker/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/shacker/subscriptions","organizations_url":"https://api.github.com/users/shacker/orgs","repos_url":"https://api.github.com/users/shacker/repos","events_url":"https://api.github.com/users/shacker/events{/privacy}","received_events_url":"https://api.github.com/users/shacker/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":48,"created_at":"2017-03-21T00:37:51Z","updated_at":"2017-11-18T00:35:36Z","closed_at":null,"author_association":"NONE","body":"I was planning to submit a PR here today, but I've hit a roadblock. Setup:\r\n\r\nWe use django_cas_ng and our users auth against a CAS SSO system. When they click the Logout link on our site, they are logged out of the site AND redirected to our campus SSO system's logout page, which kills their ticket. This is important, especially for multi-user lab computers.\r\n\r\nAfter installing django-session-security, clicking the Logout link manually still works normally. But if I let a user time out with DSS, they are logged out but they are NOT redirected to the SSO logout view. They stay on the site. In this state, the user can click the Login link again and be logged in automatically again **without** having to authenticate (because the CAS session ticket is still alive). That's bad.\r\n\r\nSo I started a PR that lets the dev set a custom logout URL. If present, the middleware.py adds a simple redirect after `logout()`:\r\n\r\n1) \r\n```\r\n        if delta >= timedelta(seconds=expire_seconds):\r\n            logout(request)\r\n            return HttpResponseRedirect(settings.LOGOUT_REDIRECT_URL)\r\n```\r\n\r\n(this is in `process_request()`). The problem is that the redirect never happens after timeout - the user is logged out but the page is not redirected to `settings.LOGOUT_REDIRECT_URL`. I don't understand why. \r\n\r\nIf I modify it to go to the CAS logout page without performing an internal logout first:\r\n\r\n2) \r\n```\r\n        if delta >= timedelta(seconds=expire_seconds):\r\n            return HttpResponseRedirect(settings.LOGOUT_REDIRECT_URL)\r\n```\r\n\r\nThen a timeout logout *does* redirect, but if the user then tries to go back to the site (e.g. to log in as someone else), they're stuck in a loop eternally handing off to settings.LOGOUT_REDIRECT_URL, so they can't access the site at all. \r\n\r\nI can't seem to make this work either way. Any idea what I'm missing here? It seems clear that No. 1 is what I want, but I can't figure out why the redirect never fires. \r\n\r\nn.b. I also have code to call django_cas_ng's `logout()` function rather than Django's, but that doesn't affect the problem - it's the same either way.\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/yourlabs/django-session-security/issues/comments/345402281","html_url":"https://github.com/yourlabs/django-session-security/issues/93#issuecomment-345402281","issue_url":"https://api.github.com/repos/yourlabs/django-session-security/issues/93","id":345402281,"user":{"login":"claytondaley","id":1097439,"avatar_url":"https://avatars1.githubusercontent.com/u/1097439?v=4","gravatar_id":"","url":"https://api.github.com/users/claytondaley","html_url":"https://github.com/claytondaley","followers_url":"https://api.github.com/users/claytondaley/followers","following_url":"https://api.github.com/users/claytondaley/following{/other_user}","gists_url":"https://api.github.com/users/claytondaley/gists{/gist_id}","starred_url":"https://api.github.com/users/claytondaley/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/claytondaley/subscriptions","organizations_url":"https://api.github.com/users/claytondaley/orgs","repos_url":"https://api.github.com/users/claytondaley/repos","events_url":"https://api.github.com/users/claytondaley/events{/privacy}","received_events_url":"https://api.github.com/users/claytondaley/received_events","type":"User","site_admin":false},"created_at":"2017-11-18T00:35:36Z","updated_at":"2017-11-18T00:35:36Z","author_association":"CONTRIBUTOR","body":"Fig 16 says it's \"login\" not logout"}}
{"actor":{"display_login":"claytondaley"}}