Fix logout session teardown

backend/app/identity.py

@@ -202,8 +202,14 @@ def set_session_cookie(response: Response, request: Request, token: str) -> None
     )
 
 
-def clear_session_cookie(response: Response) -> None:
-    response.delete_cookie(SESSION_COOKIE, path="/", httponly=True, samesite="lax")
+def clear_session_cookie(response: Response, request: Request) -> None:
+    response.delete_cookie(
+        SESSION_COOKIE,
+        path="/",
+        secure=request_uses_https(request),
+        httponly=True,
+        samesite="lax",
+    )
 
 
 def audit_event(
@@ -378,8 +384,8 @@ def login(payload: LoginRequest, request: Request, response: Response):
 
 
 @router.post("/api/auth/logout")
-def logout(response: Response):
-    clear_session_cookie(response)
+def logout(request: Request, response: Response):
+    clear_session_cookie(response, request)
     return api_response(data={"logged_out": True})
 
 
@@ -726,7 +732,7 @@ def install_identity_middleware(app) -> None:
             if not user:
                 destination = "/login?next=" + quote(path, safe="/")
                 response = RedirectResponse(destination, status_code=303)
-                clear_session_cookie(response)
+                clear_session_cookie(response, request)
                 return response
             permission = required_page_permission(path)
             if not user_has_permission(user, permission):

scripts/test-dev-baseline.sh

@@ -45,7 +45,8 @@ status_for() {
     local body="${4:-}"
     local args=(--silent --output /dev/null --write-out '%{http_code}' -X "${method}")
     if [[ -n "${cookie_jar}" ]]; then
-        args+=(-b "${cookie_jar}")
+        # Read and update the jar so logout and refreshed cookies behave like a browser.
+        args+=(-b "${cookie_jar}" -c "${cookie_jar}")
     fi
     if [[ -n "${body}" ]]; then
         args+=(-H 'Content-Type: application/json' --data "${body}")