From 816da519dd517e968aa116703958241e4c4e3402 Mon Sep 17 00:00:00 2001
From: JC <lussierj@gmail.com>
Date: Tue, 28 Jul 2026 13:52:02 +0000
Subject: [PATCH] Fix logout session teardown

---
 backend/app/identity.py      | 16 +++++++++++-----
 scripts/test-dev-baseline.sh |  3 ++-
 2 files changed, 13 insertions(+), 6 deletions(-)

diff --git a/backend/app/identity.py b/backend/app/identity.py
index 9d7ef3c..6a0f94c 100644
--- a/backend/app/identity.py
+++ b/backend/app/identity.py
@@ -202,8 +202,14 @@ def set_session_cookie(response: Response, request: Request, token: str) -> None
     )
 
 
-def clear_session_cookie(response: Response) -> None:
-    response.delete_cookie(SESSION_COOKIE, path="/", httponly=True, samesite="lax")
+def clear_session_cookie(response: Response, request: Request) -> None:
+    response.delete_cookie(
+        SESSION_COOKIE,
+        path="/",
+        secure=request_uses_https(request),
+        httponly=True,
+        samesite="lax",
+    )
 
 
 def audit_event(
@@ -378,8 +384,8 @@ def login(payload: LoginRequest, request: Request, response: Response):
 
 
 @router.post("/api/auth/logout")
-def logout(response: Response):
-    clear_session_cookie(response)
+def logout(request: Request, response: Response):
+    clear_session_cookie(response, request)
     return api_response(data={"logged_out": True})
 
 
@@ -726,7 +732,7 @@ def install_identity_middleware(app) -> None:
             if not user:
                 destination = "/login?next=" + quote(path, safe="/")
                 response = RedirectResponse(destination, status_code=303)
-                clear_session_cookie(response)
+                clear_session_cookie(response, request)
                 return response
             permission = required_page_permission(path)
             if not user_has_permission(user, permission):
diff --git a/scripts/test-dev-baseline.sh b/scripts/test-dev-baseline.sh
index 40436e2..3e35396 100755
--- a/scripts/test-dev-baseline.sh
+++ b/scripts/test-dev-baseline.sh
@@ -45,7 +45,8 @@ status_for() {
     local body="${4:-}"
     local args=(--silent --output /dev/null --write-out '%{http_code}' -X "${method}")
     if [[ -n "${cookie_jar}" ]]; then
-        args+=(-b "${cookie_jar}")
+        # Read and update the jar so logout and refreshed cookies behave like a browser.
+        args+=(-b "${cookie_jar}" -c "${cookie_jar}")
     fi
     if [[ -n "${body}" ]]; then
         args+=(-H 'Content-Type: application/json' --data "${body}")