ThePalaceProject / web-patron / 21526438905

77%

main: 77%

push

github

Show warning page after SAML/Clever sign out (PP-3423) (#88)

## Description

When a SAML- or Clever-authenticated user signs out, they are are
redirected to a sign out warning page that instructs them to close their
browser to fully logout. This page also explains the security (and
other) implications of not doing so.

Notes: 
- Completing the logout requires user action (closing the browser) and
cannot currently be accomplished automatically.
- I did not have a way to verify either the problem or the solution for
Clever authentication, but the authorization handlers appeared similar
enough that I figured these changes would leave us at a good starting
point when we do need to address Clever auth.

## Motivation and Context

No Warning About IdP Session Persistence:
- Users weren't informed that signing out of the app doesn't sign them
out of the identity provider.
- On shared computers, another person could be auto-signed into the
authenticated users account without needing to provide credentials.
    - This is a serious security issue on shared/public computers.

[Jira PP-3423]

## How Has This Been Tested?

- Manually tested in local development environment.
- All checks pass locally.
- [CI
checks](https://github.com/ThePalaceProject/web-patron/actions/runs/20624808600)
pass.

## Checklist:

- N/A I have updated the documentation accordingly.
- [x] All new and existing tests passed.

57 of 74 branches covered (77.03%)

Branch coverage included in aggregate %.

71 of 92 relevant lines covered (77.17%)

11.84 hits per line