Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

[🐛 Bug]: OAuth2 Proxy logout leaves the Auth.js session active when switching users

Open Beginner friendly
  • Is something wrong?
#6,888 0 comments 1 reaction 0 assignees View on GitHub

Maintainers usually reply within 1 day

@juanbailon is already working on this.

Since Oct 22, 2026.

  • #6889 by @juanbailon — open

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
73/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Active
Tech stack
typescript
Domain
authentication, frontend

Research direction

Start with keep-ui/shared/lib/hooks/useSignOut.ts at the linked v0.52.0 lines and trace how its OAuth2 Proxy branch handles Auth.js sign-out before redirecting. Reproduce the user-switch flow with AUTH_TYPE=OAUTH2PROXY, then verify that /api/auth/session identifies user B after signing out and back in.

Written by the indexing model from the issue text.

Description

Describe the bug

With AUTH_TYPE=OAUTH2PROXY, signing out of Keep and signing in as another user in the same browser can preserve the previous user's identity in Keep's frontend session. This was confirmed by inspecting /api/auth/session, so it is not only a stale username in the UI.

To check the /api/auth/session endpoint, this can be use the browser console:

fetch("/api/auth/session")
  .then(r => r.json())
  .then(s => console.log({
    name: s.user?.name,
    email: s.user?.email,
    role: s.userRole
  }));

To Reproduce

  1. Configure Keep with AUTH_TYPE=OAUTH2PROXY, OAuth2 Proxy, and Keycloak as the identity provider. Configure the proxy's backend-logout-url to log out of the identity provider.
  2. Sign in as user A (admin).
  3. Sign out using Keep's UI.
  4. Sign in as user B (NOC) in the same browser, without clearing cookies or opening a fresh private window.
  5. Check the displayed username and inspect the response from /api/auth/session in the browser's developer tools(console).

Actual behavior

Keep retains user A's frontend session identity after signing in as user B.

Expected behavior

Keep clears its internal Auth.js session before continuing with OAuth2 Proxy logout. After signing in as user B, the UI and /api/auth/session should identify user B.

Screenshots
If applicable, add screenshots to help explain your problem.

Additional context

  • The behavior was reproduced on Keep-ui v0.52.0.
  • useSignOut.ts redirects directly to /oauth2/sign_out and returns without calling Auth.js signOut.
  • Making the callback async and adding await signOut({ redirect: false }) before assigning window.location.href fixed the observed behavior on v0.52.0.

Related reports and changes:

Dominant language
Python
Stars
12.4k
Forks
1.5k
Avg merge
20h 5m
Merged PRs (30d)
1

Getting set up

This project ships no dev container, Dockerfile or contributing guide, so setting up is up to you: start from its README, and see our first-contribution guide for the general steps.

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from keephq/keep

All issues in keephq/keep

Similar issues

More Python issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.