Prevent authenticated pages appearing after logout

2026-08-01 13:35:30 +05:30
parent 2c415c38b9
commit 181d4f2c2e
3 changed files with 57 additions and 1 deletions
@@ -910,5 +910,21 @@ def change_password_required(request: Request):
@router.get("/logout")
 def logout(request: Request):
    request.session.clear()
-    return RedirectResponse(url="/login", status_code=303)
+
+    response = RedirectResponse(url="/login", status_code=303)
+    settings = get_settings()
+    response.delete_cookie(
+        key=settings.COOKIE_SESSION_NAME,
+        path="/",
+        secure=settings.COOKIE_SECURE,
+        httponly=True,
+        samesite=settings.COOKIE_SAMESITE,
+    )
+    response.headers["Cache-Control"] = (
+        "no-store, no-cache, must-revalidate, private, max-age=0"
+    )
+    response.headers["Pragma"] = "no-cache"
+    response.headers["Expires"] = "0"
+    response.headers["Clear-Site-Data"] = '"cache"'
+    return response