v0.5.1 — Expiring JSON Redis sessions, reliable logout, login_url()

Includes 0.4.3 and 0.5.0, which were not released separately.

Upgrading with mode='redis': sessions are now stored as JSON in one expiring key per session. Sessions from earlier versions are ignored (users log in again) unless you start once with allow_pickle=True to migrate them. See 0.5.0 below.

uv add "easyoidc>=0.5.1"

0.5.1

Added

• client.login_url(next='/path'): login route URL with ?next=, so apps
  don't hardcode it.
• client.session_storage (public access to the SessionHandler) and
  SessionHandler.count() (number of stored sessions, pending logins
  included).
• get_rp_initiated_logout_url(): the RP-initiated logout URL under a
  provider-neutral name. get_keycloak_logout_url() is kept as a deprecated
  alias.

Changed

• get_logout_url() uses RP-initiated logout for every provider that has a
  logout_endpoint, not only when auth_service == 'keycloak'. Before, a
  provider detected as google returned None even with a
  logout_endpoint set. Auth0 is unchanged.

Docs

• README: public pages with an optional user (current_user,
  login_url(), unrestricted_routes matching and the /* pitfall), logout
  per provider (Google has no IdP logout), count().

0.5.0

Changed (breaking for mode='redis')

• Redis sessions expire. Each session is now its own key,
  {namespace}:{session id}, written with SET ... EX ttl. Before, all
  sessions were fields of one hash, which can't expire, so sessions without a
  logout stayed in Redis forever with their tokens. ttl defaults to 14 days
  (the FastAPI cookie lifetime) and is renewed on every write (token refresh);
  ttl=None disables it. keys() and reset_keys() use SCAN.
• JSON instead of pickle. Values are stored as JSON. With pickle, whoever
  could write to Redis could run code in the app.
• Migration: sessions from earlier versions (the {namespace} hash) are
  ignored, so users log in again, and a warning is logged at startup. To keep
  them, start once with SessionHandler(mode='redis', allow_pickle=True):
  each one is moved to the new format when read. Remove the option afterwards.

Added

• SessionHandler(mode='redis', url=...) (redis://, rediss://, ACL
  users). Any other keyword (username, ssl, socket_timeout,
  health_check_interval, ...) is passed to redis.Redis; before, only
  host, port, db and password were used and the rest was ignored.
• socket_timeout and socket_connect_timeout default to 5 seconds. Without
  them a Redis outage hung every request.
• SessionHandler.ping() for health checks.
• redis_client accepts any object with get, set, delete, exists,
  scan_iter and ping (e.g. wrappers). Before, a client that was
  not a redis.Redis was silently ignored and a default client was created;
  now an incompatible object raises TypeError.

Tests

• Redis tests against a real server (EASYOIDC_TEST_REDIS_URL, default
  redis://localhost:6379/15, namespace easyoidc-test), including a full
  login/logout. The old Redis test no longer touches the default sessions
  namespace in db 0.

0.4.3

Fixed

• Logout did not close the IdP session when the server-side session was
  lost. If the session id in the cookie was not in the store (memory
  storage after a restart or --reload, several processes with memory
  storage, expired or deleted entry), /logout only redirected to
  post_logout_uri. The Keycloak SSO session stayed alive and the next login
  was silent, so "Logout" seemed not to work. /logout now redirects to the
  IdP logout with client_id and post_logout_redirect_uri, without
  id_token_hint (Keycloak 18+ shows a confirmation page). Applies to
  FastAPI, Flask and NiceGUI.
• A warning is logged (logger EasyOIDC) when /logout gets a session id
  that is not in the store.
• SessionHandler(mode='memory') logs a warning when the app seems to run
  in several processes (WEB_CONCURRENCY > 1, or --workers N > 1 /
  -w N > 1 on the command line). Sessions in memory are not shared between
  processes; use mode='redis'.

Added

• logout_without_token setting: 'idp' (default, new behaviour) or
  'local' (only clear the local session, as before 0.4.3).

Full changelog: v0.4.2...v0.5.1