cloud: end the WorkOS session on sign out#1446
Merged
Merged
Conversation
Logout only cleared the local sealed-session cookie; the hosted AuthKit session survived, so the next Sign in silently re-authenticated without credentials (#1445). Follow WorkOS's documented sign-out: extract the session id from the sealed cookie locally (plain JWT decode, no verification, so an expired token still signs out), 302 through the WorkOS logout endpoint to end the session upstream, and land back on the public homepage via return_to. If the cookie will not unseal, fall back to the old redirect-to-/ so local sign-out always completes. The shell submits sign-out as a top-level form POST instead of fetch so the browser navigation carries WorkOS's cookies through the hop. Needs @executor-js/emulate 0.13.6 (the emulator's session-end route).
Deploying with
|
| Status | Name | Latest Commit | Preview URL | Updated (UTC) |
|---|---|---|---|---|
| ✅ Deployment successful! View logs |
executor-marketing | 00a1502 | Commit Preview URL Branch Preview URL |
Jul 21 2026, 06:18 PM |
Deploying with
|
| Status | Name | Latest Commit | Updated (UTC) |
|---|---|---|---|
| ✅ Deployment successful! View logs |
executor-cloud | 00a1502 | Jul 21 2026, 06:20 PM |
RhysSullivan
marked this pull request as ready for review
July 21, 2026 18:18
Contributor
Cloudflare previewTorn down — the PR is closed. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #1445.
Sign out cleared only the local sealed-session cookie; the hosted AuthKit session survived, so clicking Sign in again silently re-authenticated without credentials.
This follows WorkOS's documented sign-out flow:
WorkOSClient.logoutUrlunseals the cookie locally and plain-decodes the access token for thesidclaim (no signature verification, so an expired token still signs out), then builds the logout URL with the SDK's URL builder. No network call./; local cookies clear either way.Verification: full cloud e2e green (181 passed / 10 skipped) against
@executor-js/emulate0.13.6, which adds the emulator's/user_management/sessions/logoutroute (revokes the session; its refresh token stops working, matching real WorkOS). The logout scenario now follows the redirect through the emulator and asserts the session id is ended upstream; the auth-hint scenario signs out through the real account menu.Deploy note: the production WorkOS dashboard needs its default sign-out redirect set to
https://executor.sh/(and the app'sreturn_toregistered) before this merges, or users land on a WorkOS default page after logout.