Logout URL for application not working?

[cmeis]

I've got some application connected to a Teleport cluster (version 9.3.4 on the server with auth/proxy and the server with the app_service).
The docs say that I can explicitely log out from an application with the "/teleport-logout" URL, like in https://app1.teleport.example.com/teleport-logout (dummy URL for explanations sake).

Doing so is giving me an answer of "Logged out."

But I can just call https://app1.teleport.example.com again and access the application without the need to re-authenticate.

Am I misunderstanding the feature, or is this unexpected / an error / a bug?

[webvictim]

I think that if your Teleport session is still logged in and you go back to the app URL after logging out, you will just be logged in again automatically.

If you're talking about being logged in inside the app (i.e. with a username/password) then this is handled by cookies, and calling /teleport-logout won't clear these.

[cmeis]

I'm talking about the Teleport session, not the app. I had expected it to work this way:

• Call app url (https://app1.teleport.example.com). Will get asked for login, then can use the app. (This works of course.)
• Call the Teleport logout URL (https://app1.teleport.example.com/teleport-loutout) will end my Teleport session. I DO get a "Logged out." message when doing this.
• I now would have EXPECTED that my Teleport session is really logged out, i.e. calling the apps' URL again will have me login to Teleport again. Instead the app is just opened. This even works when closing the browser completely and opening it up again.
• In my experiences I do have to call https://teleport.example.com and sign out there to REALLY be signed out.

Is that how it's expected to work? I find this quite counter-intuitive - or what is the purpose of the logout URL for the app after all?

[crossi704]

Any findings on this one? I have the exact same issue.
Is there any other way to really log out without having to call https://teleport.example.com/ ?

[webvictim]

When you call the app.teleport.example.com/teleport-logout endpoint, it just ends your session for that specific app.

Your session for teleport.example.com will still be active as long as you have a browser window which is active and refreshing the session, assuming you're still within the max_session_ttl (which is 8 hours by default)

If you close the browser for 10 minutes, you will be automatically logged out and have to re-login. The other option is to specifically click the "Logout" link in the web UI as you say.

[cmeis]

I'm sorry I cannot offer any more insights - we never really put Teleport into production and I've not been using it since then.