r-simple-auth: log-out supposed to use landing page

[jjkola]

I noticed from the implementation that you could supply destination page for log out through landing page mechanism. There was issues with it:

1. the landing page was accessed from session after session was reset
2. successful login clears the landing page
3. if going through registration process then the landing page is not reset nor used

Based on second point should the landing page be passed as a parameter to logout?

[Shinmera]

Yeah this is definitely an oversight in the spec and implementation. Both login and logout pages should respect the referral argument, no matter which flow is used to complete the action.

The referral has to be cleared after a successful flow though in order to avoid retaining referral information for future landings on either login or logout. As in, if you login with redirect to foo, and then logout without a redirect, it is probably not intended to redirect you to foo again, since the logout request could come from another module entirely.