From 561588624a7d898c6a38296ae8936b41b5141790 Mon Sep 17 00:00:00 2001
From: Tyler Gillispie <mrteye@gmail.com>
Date: Mon, 24 Aug 2026 16:22:15 -0700
Subject: [PATCH] feat(ui): allow direct logout redirects to safe return urls
 instead of forcing login page

---
 server/main.ts | 2 ++
 ui/mod.ts      | 3 ++-
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/server/main.ts b/server/main.ts
index 1389002..13cae72 100644
--- a/server/main.ts
+++ b/server/main.ts
@@ -1129,6 +1129,7 @@ app.get("/api/forward-auth", async (c) => {
     // If a browser is requesting a webpage on an unregistered domain, seamlessly redirect to unregistered error view
     if (accept.includes("text/html")) {
       const loginDomain = rpID || "auth.atyg.org";
+      c.header("Cache-Control", "no-store, no-cache, must-revalidate, max-age=0");
       return c.redirect(
         `https://${loginDomain}/errors/unregistered?host=${
           encodeURIComponent(host)
@@ -1191,6 +1192,7 @@ app.get("/api/forward-auth", async (c) => {
     // If a browser is requesting a webpage, seamlessly redirect to login
     if (accept.includes("text/html")) {
       const loginDomain = rpID || "auth.atyg.org";
+      c.header("Cache-Control", "no-store, no-cache, must-revalidate, max-age=0");
       return c.redirect(
         `https://${loginDomain}/login?redirect=${
           encodeURIComponent(originalUrl)
diff --git a/ui/mod.ts b/ui/mod.ts
index 8be3060..b3b35bc 100644
--- a/ui/mod.ts
+++ b/ui/mod.ts
@@ -98,7 +98,8 @@ uiApp.get("/logout", async (c) => {
   });
 
   if (safeRedirect) {
-    return c.redirect(`/login?redirect=${encodeURIComponent(safeRedirect)}`);
+    c.header("Cache-Control", "no-store, no-cache, must-revalidate, max-age=0");
+    return c.redirect(safeRedirect);
   }
   c.header("Cache-Control", "no-store, no-cache, must-revalidate, max-age=0");
   return c.redirect("/login");