Revert "PP-15376 session logout functionality"

src/lib/auth.ts

@@ -40,6 +40,6 @@ export function revokeSession(req: Request, res: Response, next: NextFunction) {
   logger.info(`Revoking session for user ${req.user && req.user.username}`)
     req.logout((err?: unknown) => {
         if (err) return next(err);
-        res.redirect('/auth');
+        res.redirect('/');
     });
 }

src/web/modules/layout/user_banner.njk

@@ -13,18 +13,10 @@
     </div>
 
     <div class="user-profile__item right">
-      <span>
-        <form method="POST" action="/logout">
-          {{ govukButton({
-            text: "Sign out"
-            })
-            }}
-          <input type="hidden" name="_csrf" value="{{ csrf }}">
-        </form>
-      </span>
+      <span><a class="govuk-link govuk-link--no-visited-state" href="/logout">Clear session</a></span>
     </div>
   {% else %}
     <div class="user-profile__item">(OAUTH disabled)</div>
   {% endif %}
   </div>
-</div>
+</div>

src/web/router.js

@@ -36,26 +36,13 @@ const router = express.Router()
 const storage = multer.memoryStorage()
 const upload = multer({storage})
 
-const {
-  rateLimitMiddleware
-} = require('@govuk-pay/pay-js-commons/lib/utils/middleware/csp')
-
-router.get(
-  '/auth',
-  passport.authenticate('github', {
-    scope: ['user:email'],
-    prompt: 'consent',
-  })
-);
-
+router.get('/auth', passport.authenticate('github'))
 router.get('/auth/github/callback', (req, res, next) => {
   passport.authenticate('github', {
     failureRedirect: '/auth/unauthorised',
-    successRedirect:
-      (req.session && req.session.authBlockedRedirectUrl) || '/',
-  })(req, res, next);
-});
-
+    successRedirect: req.session && req.session.authBlockedRedirectUrl || '/'
+  })(req, res, next)
+})
 router.get('/auth/unauthorised', auth.unauthorised)
 
 router.get('/', auth.secured(PermissionLevel.VIEW_ONLY), landing.root)
@@ -203,7 +190,7 @@ router.post('/events/by_date', auth.secured(PermissionLevel.USER_SUPPORT), event
 router.get('/parity-checker', auth.secured(PermissionLevel.USER_SUPPORT), events.parityCheckerPage)
 router.post('/parity-checker', auth.secured(PermissionLevel.USER_SUPPORT), events.parityCheck)
 
-router.post('/logout', rateLimitMiddleware, auth.secured(PermissionLevel.VIEW_ONLY), auth.revokeSession)
+router.get('/logout', auth.secured(PermissionLevel.VIEW_ONLY), auth.revokeSession)
 
 router.get('/healthcheck', healthcheck.response)
 

src/web/server.js

@@ -65,11 +65,6 @@ function configureSecureHeaders(instance) {
     crossOriginResourcePolicy: { policy: "cross-origin" }
   }))
   instance.use(csurf())
-
-  instance.use((req, res, next) => {
-    res.locals.csrf = req.csrfToken()
-    next()
-  })
 }
 
 function configureRequestParsing(instance) {