WordPress.com Toolbar: fix sign out redirect

[vindl]

Previously the user was redirected to wp-admin/undefined and would not be signed out properly.

Fixes #8142

Testing instructions:

1. Use test Jetpack site with WordPress.com toolbar module enabled.
2. Open the profile submenu and click on Sign Out button.
3. You should signed out and redirected to login page.

Note: this worked properly before, but some unrelated changes in the meantime, which I didn't track down yet, caused it to break. For reference check #6791 where we tested this behavior both for Jetpack site and WP.com side.

[oskosk]

Tests well! 🚢

[oskosk]

Actually, this is not working right.

I always get logged out from my site successfully but
The automagic logout from .com is weird. After clicking signout, I'm logged out from my site, and I Cannot access some sites like P2s but I'm still able to use wordpress.com (i.e. calypso) and for example see /me without problems)

[oskosk]

For the records... What I've just said before, happens if I'm proxied. Somehow my session for .com does not get invalidated. Dropping the proxy, shows that I need to login when visiting plain wordpress.com.

@vindl if this is expected behaviour, just tell so and I'll approve this PR again.

[vindl]

@oskosk not sure if it's expected, but it doesn't sound related to this PR. Could be some Calypso weirdness with logged in state while proxied.

[oskosk]

@vindl But what's the intended behaviour ? To log me out of my site or log me out of my site and wordpress.com ? One of those is not working 100% right. I just found one condition where it does not work. Maybe there are others. Is there a resource I can read about why we log out from wordpress.com ? I don't understand 100% why we do that. This button here looks similar to Calypso's but Calypso's does not log me out of my site, it just logs me out of the system I'm looking at.

[oskosk]

Approving as the author said the issue I observed is not related to this PR. 🚢

[ehti]

This previously used to log us out of WP.com account too, when proxied. It's used quite a lot in AT.

[oskosk]

@ehti @vindl would it be more appropriate to log the user out from .com only if the user clicking the button is connected to the site via SSO instead?

[ehti]

@oskosk Perhaps, though not super sure, as the case I mentioned works via SSO.

[oskosk]

Alright, this may be the topic for another discussion. I'm going to post about it. @ehti could you approve this PR if it works well for you so we can get it merged ?

[vindl]

@vindl But what's the intended behaviour ? To log me out of my site or log me out of my site and wordpress.com ? One of those is not working 100% right.

The intended behavior is to log out both from Jetpack site and WP.com. The reason behind this decision has to do with Atomic sites - we were trying to keep the behavior consistent after the transfer (e.g. what would happen if we performed this action on a dotcom site).

@ehti @vindl should it be more appropriate to log the use from .com only if the user clicking the button is connected to the site via SSO instead?

In the context of Atomic given above, I think it makes sense to log out any WP.com connected user. On the other hand that might be not be expected in case of non-Atomic Jetpack sites.

[vindl]

Just a side note: I'm noticing some weirdness with logout on dotcom sites too (unrelated to Jetpack masterbar). If I open Calypso in one tab, and log out from front end masterbar in another, I can still keep browsing in the first tab even after a hard refresh. The POST requests to API will fail authorization though (You do not have permission to access this resource.) since the user is not really logged in anymore.

[ehti]

Up to you folks how you'd like to go ahead with this PR, #6791 is the intended behavior as vindl mentioned for consistency. If that's good and the only case affected is when proxied (i.e. not signed out of .com), I think that might be separate indeed. :) (Don't think I can approve the PR? not sure.)

[oskosk]

@ehti ah don't worry. I'm merging this one then.

, #6791 is the intended behavior as vindl mentioned for consistency

But take in account that there's no consistency on the proposal from #6791. When I logout from calypso I don't expect to be logged out from my sites at the same time (of course unless I'm SSOed)... If we're overriding the button that regular Jetpack users use to logout, it's not good to do magical stuff on the background for them. What if they're drafting or uploading something to Calypso on another tab to another site? This is just unexpected.