| id |
status |
status_updated |
status_note |
component |
severity |
timestamp |
last_seen |
occurrences |
files |
tags |
related |
fix_commits |
gitea_issue |
gitea_synced_status |
gitea_synced_hash |
| bug-1959 |
fixed |
2026-10-10 |
|
xcecli |
security |
2026-10-10T10:15:59Z |
2026-10-10T10:15:59Z |
1 |
| src/frontend/xcecli/cmd/auth |
|
|
|
|
390 |
fixed |
8b68f96ce374 |
bug-1959: xcecli logout only clears local config and never calls the logout API, so the token is not revoked
Description
Observed: (source reading; follow-up of the 2026-10-10 P0 fixes (bug-1936..1957))
Reported by the bug-1946 fix: server-side token revocation exists (POST /xce/v1/auth/logout), but xcecli logout deletes the local token without calling it, so the token stays valid until expiry.
Expected: xcecli logout calls the logout API (best effort) before clearing local state.
Impact: Security: a CLI token survives logout.
Found by: follow-up of the 2026-10-10 P0 fixes (bug-1936..1957)
Environment
- OS: no /etc/os-release; Docker container; NixOS kernel; kernel Linux 6.18.33 x86_64
- libc: glibc 2.42-47 (dev shell;
xcecli itself is a statically linked Go binary, CGO disabled)
- Toolchain: gcc (GCC) 15.2.0, meson 1.9.1
- Build: asan (xce.build)
- Code: scheduler-framework @ 19be145d-dirty
- Deployment: any (found by source reading; confirmed by the RED test of the fix)
Reproduction
xcecli login, copy the token, xcecli logout.- Call any API with the copied token: it succeeds.
- Frequency: deterministic (by code reading; confirmed by the RED test of the fix)
- Evidence: the code sites quoted in Description; no logs kept.
Root cause
runLogout (src/frontend/xcecli/cmd/auth/logout.go) only removed the server entry from the local config; the CLI never called the logout API, so the token stayed valid server side until expiry. Pre-existing.
Fix
New APIClient.Logout(token) (common/request/request.go) posts /xce/v1/auth/logout with the bearer token; runLogout calls it first and, if the server is unreachable or rejects the token, warns server-side token revocation could not be confirmed and still clears local state; help text updated.
Verification
- Test:
TestRunLogout_RevokesTokenOnServer (cmd/auth/logout_test.go, httptest): RED logout_test.go:124: requests = [], want ["POST /xce/v1/auth/logout Bearer tok"]; TestRunLogout_ServerFailureStillClearsLocalState (rejected and unreachable server) RED logout_test.go:157; GREEN after (5 auth tests).
- Suites:
xce-build.sh all asan xce.build --incremental on the merged branch, 2026-10-10: C suites Ok 157 / Fail 0; frontend Go tests ok (the build now also runs apiserver cmd, middleware, models and router)
- Live: n/a: unit/fixture-level verification; no live deployment was run
References
- Fix commits:
03798230 (on scheduler-framework)
- Found as a follow-up of the 2026-10-10 P0 fixes (bug-1936..1957)
