TPAC logout does not delete session

[Jeff Godin]

When a user logs out of the TPAC public catalog interface, the session is not deleted. The cookie on the client is cleared, but the session remains in memcached, and the authentication token can continue to be used, if it was retained via some means other than the standard browser cookie mechanisms.

The session will eventually expire after a configurable period of inactivity. The period will vary depending on if the session was created as a standard or as a persistent session.

In the JSPAC and Staff Client, "logout" deletes the session using a call to open-ils.auth.session.delete

We should do the same thing in TPAC.

[Mike Rylander (mrylander)]

There's a branch for that in the security repo called: user/miker/lp1248636_logout-delete-session

[Galen Charlton (gmc)]

I've tested and pushed a signoff to the branch user/gmcharlt/lp1248636_signoff in the security repo.

[Jason Stephenson (jstephenson)]

FWIW, I tested the branch today and confirmed that it works. I also cherry-picked it into local copies of rel_2_5 and rel_2_6 just to verify that it backports cleanly, whcih it does. (No surprise there, but just making sure.)

I won't bother signing off since Galen already has.