- avoid removing session for cookie auth if LoginCookieDeleteAll is
disabled
- redirect user to other server rather than to login page
- show message about partial logout
- adjust tests
- this is based on #13221Fixes#12301
Signed-off-by: Michal Čihař <michal@cihar.com>
There is no need to do that as we rely on session cookies anyway. Also
appending sesson ID to external URLs is not a good idea.
Signed-off-by: Michal Čihař <michal@cihar.com>
- add separate script for handling logout
- no longer require old_usr for all authentication methods
(this avoids potential information leak)
- require valid token for logout
Signed-off-by: Michal Čihař <michal@cihar.com>
This allows us to test the code without using runkit. Currenly only
AuthenticationHttp is migrated to new code, but others will follow.
Signed-off-by: Michal Čihař <michal@cihar.com>