fix: Refresh Panel globals after logout

[distantnative]

Review

• Rough pass
• Manual testing

Description

Auth::logout() removes kirby.csrf from the session since v5.6.0. The logout view then redirects with Panel::go('login'), which the Panel follows in place, so the browser keeps $system.csrf from before the logout while the session no longer has a token at all.

The logout view now asks for the globals it invalidated: Panel::go('login?_globals=$system,$translation').

I didn't go with Panel::go(url: 'login', refresh: 0): Response::refresh() sends a 302 with a Refresh header and no Location, so the Panel's fetch can't follow it, falls through to RedirectError, and bounces the browser back to /panel/logout.

Changelog

🐛 Bug fixes

• Logging back in right after logging out of the Panel no longer fails with "Invalid CSRF token"
  "Invalid CSRF token" when logging back in after logging out of the Panel #8502
• Internal Panel state request params (_globals, _json, _only, _pretty) no longer show up in the Panel URL
• Panel's API requests now always use the current CSRF token instead of the one from the initial page load

For review team

• Add changes & docs to release notes draft in Notion

[afbora]

Same issue happens on code login: the logout() call inside verifyChallenge() removes the token, but LoginCodeForm only calls this.$reload() without asking for globals. Changing it to this.$reload({ globals: ["$system", "$translation"] }) like in LoginForm fixes it.

[distantnative]

@afbora Added a fix for that too

[afbora]

You might want to add a regression test for LoginCodeForm. Still LGTM anyway 👍

[distantnative]

@afbora I will look into that for v6 which has rewritten that code completely, so the merge forward will be interesting anyways.