From bbd73272c06593a43c2c2da2e9645b0a0f677ed0 Mon Sep 17 00:00:00 2001
From: Dmitry Verkhoturov <paskal.07@gmail.com>
Date: Sat, 10 Oct 2026 23:45:59 +0200
Subject: [PATCH 1/3] Fill the configured site into the demo pages the binary
 serves

The build emits the demo, counter and last-comments pages for site
remark. The docker image replaces that with the first configured site
at container start, but the binary served them as built, so on an
instance serving another site the demo's API requests failed with
"site not found" and its widget asked about a site the reader was not
signed in to.

The file server now fills in the first configured site the same way,
in the html files the docker image rewrites, and the site is part of
the cache validator so a changed SITE is not answered with 304. The
release build fails if those pages lose the site_id:"remark" literal
the server replaces and the docker image's pattern expects.
---
 backend/app/cmd/server.go             | 13 +++++
 backend/app/cmd/server_test.go        | 18 +++++++
 backend/app/rest/api/rest.go          | 14 ++---
 backend/app/rest/api/rest_test.go     |  2 +-
 backend/app/rest/api/webfiles.go      | 21 ++++++++
 backend/app/rest/api/webfiles_test.go | 73 ++++++++++++++++++++++++++-
 scripts/prepare-release-assets.sh     | 10 ++++
 7 files changed, 142 insertions(+), 9 deletions(-)

diff --git a/backend/app/cmd/server.go b/backend/app/cmd/server.go
index 8892449bcd..960e4660eb 100644
--- a/backend/app/cmd/server.go
+++ b/backend/app/cmd/server.go
@@ -741,6 +741,7 @@ func (s *ServerCommand) newServerApp(ctx context.Context) (*serverApp, error) {
 		WebRoot:                    s.WebRoot,
 		WebFS:                      webFS,
 		RemarkURL:                  s.RemarkURL,
+		DemoSiteID:                 s.demoSiteID(),
 		ImageProxy:                 imgProxy,
 		CommentFormatter:           commentFormatter,
 		Migrator:                   migr,
@@ -1558,6 +1559,18 @@ func (s *ServerCommand) servesAudience(auds []string) bool {
 	return true
 }
 
+// demoSiteID is the site the demo pages under /web show: the first configured one, as the docker
+// image picks it from SITE. It is returned exactly as configured, since the stores register it
+// that way and look it up by exact match
+func (s *ServerCommand) demoSiteID() string {
+	for _, site := range s.Sites {
+		if strings.TrimSpace(site) != "" {
+			return site
+		}
+	}
+	return ""
+}
+
 func (s *ServerCommand) parseSameSite(ss string) http.SameSite {
 	switch strings.ToLower(ss) {
 	case "default":
diff --git a/backend/app/cmd/server_test.go b/backend/app/cmd/server_test.go
index 36d7a2ffe1..65ab6b7b28 100644
--- a/backend/app/cmd/server_test.go
+++ b/backend/app/cmd/server_test.go
@@ -1491,3 +1491,21 @@ func TestServerCommand_servesAudience(t *testing.T) {
 	cmd.Store.Type = "rpc"
 	assert.True(t, cmd.servesAudience([]string{"Remark"}), "a remote store decides which sites exist")
 }
+
+func TestServerCommand_demoSiteID(t *testing.T) {
+	tbl := []struct {
+		sites []string
+		want  string
+	}{
+		{[]string{"remark"}, "remark"},
+		{[]string{"myblog", "other"}, "myblog"},
+		// the stores register a site exactly as given, so the demo pages must name it the same way
+		{[]string{" myblog "}, " myblog "},
+		{[]string{"  ", "second"}, "second"},
+		{[]string{"", "second"}, "second"},
+		{nil, ""},
+	}
+	for _, tt := range tbl {
+		assert.Equal(t, tt.want, (&ServerCommand{Sites: tt.sites}).demoSiteID(), "sites %q", tt.sites)
+	}
+}
diff --git a/backend/app/rest/api/rest.go b/backend/app/rest/api/rest.go
index 15ad5a645c..4ef70a6d8d 100644
--- a/backend/app/rest/api/rest.go
+++ b/backend/app/rest/api/rest.go
@@ -47,6 +47,7 @@ type Rest struct {
 	WebRoot         string
 	WebFS           fs.FS
 	RemarkURL       string
+	DemoSiteID      string // site the demo pages under /web show, the first configured one
 	ReadOnlyAge     int
 	SharedSecret    string
 	TrustedProxies  []*net.IPNet // reverse-proxy networks whose forwarding headers (X-Real-IP, X-Forwarded-For, ...) are trusted
@@ -398,7 +399,7 @@ func (s *Rest) routes() http.Handler {
 		log.Printf("[WARN] no embedded frontend, serving built-in assets only: %v", err)
 		embeddedFrontend = emptyFS{}
 	}
-	addFileServer(router, embeddedFrontend, s.WebRoot, s.Version, s.RemarkURL)
+	addFileServer(router, embeddedFrontend, s.WebRoot, s.Version, s.RemarkURL, s.DemoSiteID)
 	return router
 }
 
@@ -514,7 +515,7 @@ func (s *Rest) configCtrl(w http.ResponseWriter, r *http.Request) {
 // serves /web from the frontend build, falling back to the assets embedded in the binary for
 // names the build does not produce. the frontend build is read from webRoot on disk, or from the
 // copy embedded at app/cmd/web when that directory is absent.
-func addFileServer(r *routegroup.Bundle, embeddedFrontend fs.FS, webRoot, version, remarkURL string) {
+func addFileServer(r *routegroup.Bundle, embeddedFrontend fs.FS, webRoot, version, remarkURL, siteID string) {
 	frontendFS := embeddedFrontend
 
 	if _, err := os.Stat(webRoot); err == nil {
@@ -529,17 +530,18 @@ func addFileServer(r *routegroup.Bundle, embeddedFrontend fs.FS, webRoot, versio
 	sources := templatedFS{
 		fs:        webFiles{frontend: frontendFS, embedded: webassets.FS},
 		remarkURL: remarkURL,
+		siteID:    siteID,
 	}
 	webFS := http.StripPrefix("/web", http.FileServer(http.FS(sources)))
 	r.HandleFunc("GET /web", http.RedirectHandler("/web/", http.StatusMovedPermanently).ServeHTTP)
 
 	r.With(rateLimiter(20),
 		R.Timeout(10*time.Second),
-		// the served body now depends on remarkURL, so it has to be part of the validator. Without
-		// it an operator who corrects a wrong REMARK_URL and restarts the same binary keeps getting
-		// 304 on revalidation, and the client keeps a bundle addressed to the old host for good,
+		// the served body now depends on remarkURL and the demo site, so both have to be part of the
+		// validator. Without them an operator who corrects REMARK_URL or SITE and restarts the same
+		// binary keeps getting 304 on revalidation, and the client keeps the old page for good,
 		// since no-cache means it revalidates rather than aging out
-		cacheControl(time.Hour, version+":"+remarkURL),
+		cacheControl(time.Hour, version+":"+remarkURL+":"+siteID),
 	).HandleFunc("GET /web/", func(w http.ResponseWriter, r *http.Request) {
 		// don't show dirs, just serve files
 		if strings.HasSuffix(r.URL.Path, "/") && len(r.URL.Path) > 1 && r.URL.Path != ("/web/") {
diff --git a/backend/app/rest/api/rest_test.go b/backend/app/rest/api/rest_test.go
index d347b2b301..0d134e12ab 100644
--- a/backend/app/rest/api/rest_test.go
+++ b/backend/app/rest/api/rest_test.go
@@ -189,7 +189,7 @@ func TestRest_FileServerBackendAssets(t *testing.T) {
 func TestRest_FileServerEmbeddedFrontend(t *testing.T) {
 	frontend := fstest.MapFS{"index.html": {Data: []byte("embedded frontend index")}}
 	router := routegroup.New(http.NewServeMux())
-	addFileServer(router, frontend, filepath.Join(t.TempDir(), "absent"), "test-version", "https://remark.example.com")
+	addFileServer(router, frontend, filepath.Join(t.TempDir(), "absent"), "test-version", "https://remark.example.com", "")
 
 	ts := httptest.NewServer(router)
 	defer ts.Close()
diff --git a/backend/app/rest/api/webfiles.go b/backend/app/rest/api/webfiles.go
index 69595e8eff..261ee6cdda 100644
--- a/backend/app/rest/api/webfiles.go
+++ b/backend/app/rest/api/webfiles.go
@@ -2,6 +2,7 @@ package api
 
 import (
 	"bytes"
+	"encoding/json"
 	"errors"
 	"io"
 	"io/fs"
@@ -77,12 +78,19 @@ func (emptyFS) Open(name string) (fs.File, error) {
 // serves the build embedded in itself and has nothing to rewrite, does it here.
 const remarkURLPlaceholder = "{% REMARK_URL %}"
 
+// demoSiteLiteral is how the built demo, counter and last-comments pages name their site. The
+// docker image replaces it with the first configured site at container start; the binary does it
+// here, since a site the instance does not serve makes those pages fail and, signed in or not, ask
+// the API about a site the reader's session does not belong to.
+const demoSiteLiteral = `site_id:"remark"`
+
 // templatedFS fills the instance URL into the files carrying the placeholder. Without it the
 // binary serves whatever the build baked in, which is a host no visitor can reach, and the widget
 // falls back to it whenever a page omits remark_config.host.
 type templatedFS struct {
 	fs        fs.FS
 	remarkURL string
+	siteID    string // first configured site, filled into the demo pages; empty leaves them as built
 }
 
 // Open substitutes in the file types the frontend templates, and hands everything else through
@@ -107,9 +115,22 @@ func (t templatedFS) Open(name string) (fs.File, error) {
 	}
 
 	body = bytes.ReplaceAll(body, []byte(remarkURLPlaceholder), []byte(t.remarkURL))
+	if t.siteID != "" && filepath.Ext(name) == ".html" {
+		body = bytes.ReplaceAll(body, []byte(demoSiteLiteral), demoSiteValue(t.siteID))
+	}
 	return &memFile{Reader: bytes.NewReader(body), info: sizedInfo{FileInfo: info, size: int64(len(body))}}, nil
 }
 
+// demoSiteValue renders the site as the demo pages' literal does. json.Marshal quotes it as a
+// script string and escapes <, > and &, so no site id can end the string or the script block
+func demoSiteValue(siteID string) []byte {
+	quoted, err := json.Marshal(siteID)
+	if err != nil { // a string always marshals; keep the build's own literal if that ever changes
+		return []byte(demoSiteLiteral)
+	}
+	return append([]byte("site_id:"), quoted...)
+}
+
 // templatedName reports whether the frontend templates this file type. It mirrors the set the
 // docker image rewrites, so both distributions substitute in the same files
 func templatedName(name string) bool {
diff --git a/backend/app/rest/api/webfiles_test.go b/backend/app/rest/api/webfiles_test.go
index 402d22134b..0660835691 100644
--- a/backend/app/rest/api/webfiles_test.go
+++ b/backend/app/rest/api/webfiles_test.go
@@ -266,6 +266,52 @@ func TestTemplatedFS_SubstitutesTheInstanceURL(t *testing.T) {
 	}
 }
 
+// TestTemplatedFS_FillsTheDemoSite covers the demo, counter and last-comments pages, which the build
+// emits for site "remark". The docker image rewrites that literal in html files at container start,
+// and the binary has to do the same, or an instance serving another site answers those pages with
+// "site not found" and their widget asks the API about a site the reader is not signed in to.
+func TestTemplatedFS_FillsTheDemoSite(t *testing.T) {
+	const built = `var remark_config={site_id:"remark",host:"` + remarkURLPlaceholder + `"}`
+	source := fstest.MapFS{
+		"index.html":  {Data: []byte(built)},
+		"counter.mjs": {Data: []byte(built)},
+		"custom.html": {Data: []byte(`var remark_config={site_id:"mine"}`)},
+	}
+
+	tbl := []struct {
+		name, file, siteID, want string
+	}{
+		{"html gets the site", "index.html", "myblog",
+			`var remark_config={site_id:"myblog",host:"https://remark.example.com"}`},
+		{"no site leaves the build's", "index.html", "",
+			`var remark_config={site_id:"remark",host:"https://remark.example.com"}`},
+		{"the site cannot end the string or the script", "index.html", `x"</script><script>alert(1)//`,
+			`var remark_config={site_id:"x\"\u003c/script\u003e\u003cscript\u003ealert(1)//",host:"https://remark.example.com"}`},
+		// the docker image rewrites the site in html only, so a script keeps the literal here too
+		{"scripts are left alone", "counter.mjs", "myblog",
+			`var remark_config={site_id:"remark",host:"https://remark.example.com"}`},
+		// only the build's own default is replaced, never a site an operator wrote into a page
+		{"another site is left alone", "custom.html", "myblog", `var remark_config={site_id:"mine"}`},
+	}
+
+	for _, tt := range tbl {
+		t.Run(tt.name, func(t *testing.T) {
+			tfs := templatedFS{fs: source, remarkURL: "https://remark.example.com", siteID: tt.siteID}
+			f, err := tfs.Open(tt.file)
+			require.NoError(t, err)
+			defer func() { assert.NoError(t, f.Close()) }()
+
+			body, err := io.ReadAll(f)
+			require.NoError(t, err)
+			assert.Equal(t, tt.want, string(body))
+
+			info, err := f.Stat()
+			require.NoError(t, err)
+			assert.Equal(t, int64(len(tt.want)), info.Size())
+		})
+	}
+}
+
 func TestTemplatedFS_PassesErrorsThrough(t *testing.T) {
 	tfs := templatedFS{fs: fstest.MapFS{}, remarkURL: "https://remark.example.com"}
 
@@ -282,7 +328,7 @@ func TestRest_FileServerFillsInTheInstanceURL(t *testing.T) {
 		"plain.html": {Data: []byte("nothing to fill in")},
 	}
 	router := routegroup.New(http.NewServeMux())
-	addFileServer(router, frontend, filepath.Join(t.TempDir(), "absent"), "test-version", "https://remark.example.com")
+	addFileServer(router, frontend, filepath.Join(t.TempDir(), "absent"), "test-version", "https://remark.example.com", "")
 
 	ts := httptest.NewServer(router)
 	defer ts.Close()
@@ -322,7 +368,7 @@ func TestRest_FileServerEtagVariesWithTheInstanceURL(t *testing.T) {
 
 	etagFor := func(remarkURL string) string {
 		router := routegroup.New(http.NewServeMux())
-		addFileServer(router, frontend, filepath.Join(t.TempDir(), "absent"), "test-version", remarkURL)
+		addFileServer(router, frontend, filepath.Join(t.TempDir(), "absent"), "test-version", remarkURL, "")
 		ts := httptest.NewServer(router)
 		defer ts.Close()
 
@@ -341,3 +387,26 @@ func TestRest_FileServerEtagVariesWithTheInstanceURL(t *testing.T) {
 		"same version and same path, different instance url: the validator has to change or the "+
 			"client keeps a bundle addressed to the old host")
 }
+
+// TestRest_FileServerEtagVariesWithTheDemoSite is the same case for SITE: the demo pages carry the
+// first configured site, so an operator who changes it must not keep getting the old page on 304
+func TestRest_FileServerEtagVariesWithTheDemoSite(t *testing.T) {
+	frontend := fstest.MapFS{"index.html": {Data: []byte(`site_id:"remark"`)}}
+
+	etagFor := func(siteID string) string {
+		router := routegroup.New(http.NewServeMux())
+		addFileServer(router, frontend, filepath.Join(t.TempDir(), "absent"), "test-version", "https://remark.example.com", siteID)
+		ts := httptest.NewServer(router)
+		defer ts.Close()
+
+		resp, err := http.Get(ts.URL + "/web/index.html")
+		require.NoError(t, err)
+		defer resp.Body.Close()
+		require.Equal(t, http.StatusOK, resp.StatusCode)
+		return resp.Header.Get("Etag")
+	}
+
+	first := etagFor("old")
+	require.NotEmpty(t, first)
+	assert.NotEqual(t, first, etagFor("new"), "a different demo site has to change the validator")
+}
diff --git a/scripts/prepare-release-assets.sh b/scripts/prepare-release-assets.sh
index e426557e01..7efaa9c81c 100755
--- a/scripts/prepare-release-assets.sh
+++ b/scripts/prepare-release-assets.sh
@@ -56,6 +56,16 @@ if ! grep -Rq "{% REMARK_URL %}" "$EMBED_DIR"; then
   exit 1
 fi
 
+# the demo pages name their site as this exact literal, which the server and docker-init.sh both
+# replace with the first configured site. A minifier writing it any other way would leave every
+# instance not serving "remark" with demo pages that fail, and nothing else would notice
+for page in index.html counter.html last-comments.html; do
+  if ! grep -Fq 'site_id:"remark"' "$EMBED_DIR/$page"; then
+    echo "error: $EMBED_DIR/$page lost its site_id:\"remark\" literal, the demo site would not be filled in" >&2
+    exit 1
+  fi
+done
+
 # `//go:embed web` in app/cmd/server.go takes the default pattern rules, which skip every name
 # beginning with a dot or an underscore. A bundle emitted under such a name would be absent from
 # the binary while still present in frontend/apps/remark42/public, so it would serve correctly from

From 5f177c86d60afd9a0dcb67809ed2719090e97486 Mon Sep 17 00:00:00 2001
From: Dmitry Verkhoturov <paskal.07@gmail.com>
Date: Sat, 10 Oct 2026 23:45:59 +0200
Subject: [PATCH 2/3] Keep the session when a request is refused with 403

The fetcher cleared the auth cookies on 403 as well as 401. The server
answers 403 to a valid session that may not do something, such as one
issued for another site served from the same remark42 host, an
anonymous user, or a non-admin. Clearing the shared XSRF cookie then
could sign the reader out of the other sites using those cookies too.

Cookies are now cleared only on 401, which is what an invalid session
gets. Logout is the one place a 403 can mean the session is over: an
expired token sent as a header is refused there, so logout now forgets
the local session whatever the server answers.
---
 .../apps/remark42/app/common/fetcher.test.ts  | 27 +++++++++++++++-
 frontend/apps/remark42/app/common/fetcher.ts  | 16 +++++++---
 .../app/components/auth/auth.api.spec.ts      | 32 ++++++++++++++++++-
 .../remark42/app/components/auth/auth.api.ts  |  9 ++++--
 4 files changed, 76 insertions(+), 8 deletions(-)

diff --git a/frontend/apps/remark42/app/common/fetcher.test.ts b/frontend/apps/remark42/app/common/fetcher.test.ts
index bc588a2cea..f6ac4c9d14 100644
--- a/frontend/apps/remark42/app/common/fetcher.test.ts
+++ b/frontend/apps/remark42/app/common/fetcher.test.ts
@@ -246,7 +246,7 @@ describe('fetcher', () => {
       consoleErrorSpy.mockRestore();
     });
 
-    it('should reset activeJwtToken and clear cookies on 401/403 responses', async () => {
+    it('should reset activeJwtToken and clear cookies on 401 responses', async () => {
       // Mock clearAuthCookie
       jest.spyOn(cookies, 'clearAuthCookie').mockImplementationOnce(jest.fn());
 
@@ -277,6 +277,31 @@ describe('fetcher', () => {
 
       expect(window.fetch).toHaveBeenCalled();
     });
+
+    it('should keep the session on 403 responses', async () => {
+      const clear = jest.spyOn(cookies, 'clearAuthCookie').mockImplementation(jest.fn());
+      jest.spyOn(window, 'atob').mockReturnValueOnce(JSON.stringify({ jti: 'test-jti-id' }));
+
+      mockFetch({ headers: { [JWT_HEADER]: 'kept.jwt.token', ...headers } });
+      await apiFetcher.get(apiUri);
+
+      // a session for another site asking about this one, or an anonymous user, is refused, not signed out
+      mockFetch({ status: 403 });
+      await expect(apiFetcher.get(apiUri)).rejects.toEqual(new RequestError('Forbidden.', 403));
+
+      expect(clear).not.toHaveBeenCalled();
+
+      mockFetch({ headers });
+      await apiFetcher.get(apiUri);
+      const { calls } = (window.fetch as jest.Mock).mock;
+      const [, init] = calls[calls.length - 1];
+      expect(init.headers[JWT_HEADER]).toBe('kept.jwt.token');
+
+      // the token lives at module level, so drop it the way the fetcher does before the next test
+      mockFetch({ status: 401 });
+      await expect(apiFetcher.get(apiUri)).rejects.toEqual(new RequestError('Not authorized.', 401));
+      clear.mockRestore();
+    });
   });
 
   describe('send data', () => {
diff --git a/frontend/apps/remark42/app/common/fetcher.ts b/frontend/apps/remark42/app/common/fetcher.ts
index 53568ca7b4..6e997b5df2 100644
--- a/frontend/apps/remark42/app/common/fetcher.ts
+++ b/frontend/apps/remark42/app/common/fetcher.ts
@@ -89,10 +89,11 @@ const createFetcher = (baseUrl: string = ''): Methods => {
         }
       }
 
-      if ([401, 403].includes(res.status)) {
-        activeJwtToken = undefined;
-        clearAuthCookie(JWT_COOKIE_NAME);
-        clearAuthCookie(XSRF_COOKIE);
+      // only 401 says the session itself is gone. A 403 comes with a valid session that may not do
+      // this, such as one belonging to another site served from the same remark42 host, and
+      // clearing on it signs the reader out of every site sharing these cookies
+      if (res.status === 401) {
+        dropSession();
       }
 
       if (res.status >= 400) {
@@ -135,6 +136,13 @@ const createFetcher = (baseUrl: string = ''): Methods => {
   } as Methods;
 };
 
+/** Forgets the session this document holds: the in-memory JWT and the auth cookies it can reach */
+export function dropSession(): void {
+  activeJwtToken = undefined;
+  clearAuthCookie(JWT_COOKIE_NAME);
+  clearAuthCookie(XSRF_COOKIE);
+}
+
 export const apiFetcher = createFetcher(`${BASE_URL}${API_BASE}`);
 export const authFetcher = createFetcher(`${BASE_URL}/auth`);
 export const adminFetcher = createFetcher(`${BASE_URL}${API_BASE}/admin`);
diff --git a/frontend/apps/remark42/app/components/auth/auth.api.spec.ts b/frontend/apps/remark42/app/components/auth/auth.api.spec.ts
index 70f22d50f2..3c38364ffc 100644
--- a/frontend/apps/remark42/app/components/auth/auth.api.spec.ts
+++ b/frontend/apps/remark42/app/components/auth/auth.api.spec.ts
@@ -1,4 +1,6 @@
-import { oauthSignin } from './auth.api';
+import { apiFetcher, JWT_HEADER } from 'common/fetcher';
+
+import { logout, oauthSignin } from './auth.api';
 
 /**
  * The OAuth flow has no message from the popup to listen for: the popup closes itself and the
@@ -116,3 +118,31 @@ describe('oauthSignin', () => {
     await assertion;
   });
 });
+
+describe('logout', () => {
+  beforeEach(() => {
+    fetchMock.resetMocks();
+  });
+
+  afterEach(() => {
+    jest.restoreAllMocks();
+  });
+
+  it('forgets a header-held session even when the server refuses the logout', async () => {
+    // a token delivered as a header is what the fetcher keeps in memory and sends back
+    jest.spyOn(window, 'atob').mockReturnValueOnce(JSON.stringify({ jti: 'jti' }));
+    fetchMock.mockResponseOnce('{}', {
+      headers: { [JWT_HEADER]: 'held.jwt.token', 'Content-Type': 'application/json' },
+    });
+    await apiFetcher.get('/anything');
+
+    // an expired header token is refused with 403 by the logout handler
+    fetchMock.mockResponseOnce(JSON.stringify({ error: 'logout not allowed' }), { status: 403 });
+    await expect(logout()).rejects.toBeDefined();
+
+    fetchMock.mockResponseOnce('{}', { headers: { 'Content-Type': 'application/json' } });
+    await apiFetcher.get('/anything');
+    const [, init] = fetchMock.mock.calls[fetchMock.mock.calls.length - 1];
+    expect((init?.headers as Record<string, string>)[JWT_HEADER]).toBeUndefined();
+  });
+});
diff --git a/frontend/apps/remark42/app/components/auth/auth.api.ts b/frontend/apps/remark42/app/components/auth/auth.api.ts
index 03f3f6ed45..50517f65f7 100644
--- a/frontend/apps/remark42/app/components/auth/auth.api.ts
+++ b/frontend/apps/remark42/app/components/auth/auth.api.ts
@@ -1,6 +1,6 @@
 import type { User } from 'common/types';
 
-import { authFetcher } from 'common/fetcher';
+import { authFetcher, dropSession } from 'common/fetcher';
 import { siteId } from 'common/settings';
 import { getUser } from 'common/api';
 
@@ -121,6 +121,11 @@ export function verifyTelegramSignin(token: string): Promise<User> {
   return authFetcher.get(TELEGRAM_SIGNIN_ENDPOINT, { token });
 }
 
+/**
+ * Signs out, and forgets the session locally whatever the server answers. With the JWT sent as a
+ * header, an expired token is refused with 403, and a fetcher that kept it would sign the reader
+ * back in on the next page load
+ */
 export function logout(): Promise<void> {
-  return authFetcher.get('/logout');
+  return authFetcher.get<void>('/logout').finally(dropSession);
 }

From 6cdc1a219bd4a2a8f0c3123a088f86d3e16c9e4a Mon Sep 17 00:00:00 2001
From: Dmitry Verkhoturov <paskal.07@gmail.com>
Date: Sun, 11 Oct 2026 08:58:13 +0200
Subject: [PATCH 3/3] Finish signing out when the server refuses the logout

The logout request dropped the local session and then rejected, and
the signout action clears the signed-in user only after it resolves,
so a refused logout, such as an expired header token answered with 403,
left the widget showing the reader as signed in without credentials.
The request failure is now ignored once the session is dropped.
---
 .../app/components/auth/auth.api.spec.ts      |  3 ++-
 .../remark42/app/components/auth/auth.api.ts  |  8 +++++--
 .../remark42/app/store/user/actions.test.ts   | 23 +++++++++++++++++--
 3 files changed, 29 insertions(+), 5 deletions(-)

diff --git a/frontend/apps/remark42/app/components/auth/auth.api.spec.ts b/frontend/apps/remark42/app/components/auth/auth.api.spec.ts
index 3c38364ffc..da4d397ba6 100644
--- a/frontend/apps/remark42/app/components/auth/auth.api.spec.ts
+++ b/frontend/apps/remark42/app/components/auth/auth.api.spec.ts
@@ -138,7 +138,8 @@ describe('logout', () => {
 
     // an expired header token is refused with 403 by the logout handler
     fetchMock.mockResponseOnce(JSON.stringify({ error: 'logout not allowed' }), { status: 403 });
-    await expect(logout()).rejects.toBeDefined();
+    // resolving lets the caller clear the signed-in state as well
+    await expect(logout()).resolves.toBeUndefined();
 
     fetchMock.mockResponseOnce('{}', { headers: { 'Content-Type': 'application/json' } });
     await apiFetcher.get('/anything');
diff --git a/frontend/apps/remark42/app/components/auth/auth.api.ts b/frontend/apps/remark42/app/components/auth/auth.api.ts
index 50517f65f7..421069da53 100644
--- a/frontend/apps/remark42/app/components/auth/auth.api.ts
+++ b/frontend/apps/remark42/app/components/auth/auth.api.ts
@@ -124,8 +124,12 @@ export function verifyTelegramSignin(token: string): Promise<User> {
 /**
  * Signs out, and forgets the session locally whatever the server answers. With the JWT sent as a
  * header, an expired token is refused with 403, and a fetcher that kept it would sign the reader
- * back in on the next page load
+ * back in on the next page load. The refusal is not passed on either: callers clear the signed-in
+ * state only once this resolves, and the credentials are gone by then
  */
 export function logout(): Promise<void> {
-  return authFetcher.get<void>('/logout').finally(dropSession);
+  return authFetcher
+    .get<void>('/logout')
+    .catch(() => undefined)
+    .finally(dropSession);
 }
diff --git a/frontend/apps/remark42/app/store/user/actions.test.ts b/frontend/apps/remark42/app/store/user/actions.test.ts
index eed3852b02..da0796b4db 100644
--- a/frontend/apps/remark42/app/store/user/actions.test.ts
+++ b/frontend/apps/remark42/app/store/user/actions.test.ts
@@ -4,8 +4,16 @@ import { LS_HIDDEN_USERS_KEY } from 'common/constants';
 import { COMMENTS_PATCH } from 'store/comments/types';
 
 import INITIAL_STORE from './__stubs__/comments-store.json';
-import { setVerifiedStatus, hideUser, unhideUser, unblockUser, fetchBlockedUsers, fetchHiddenUsers } from './actions';
-import { USER_UNHIDE, USER_HIDE, USER_UNBAN, USER_BANLIST_SET, USER_HIDELIST_SET } from './types';
+import {
+  setVerifiedStatus,
+  hideUser,
+  unhideUser,
+  unblockUser,
+  fetchBlockedUsers,
+  fetchHiddenUsers,
+  signout,
+} from './actions';
+import { USER_UNHIDE, USER_HIDE, USER_UNBAN, USER_BANLIST_SET, USER_HIDELIST_SET, USER_SET } from './types';
 
 describe('store user actions', () => {
   test('fetchBlockedUsers', async () => {
@@ -96,4 +104,15 @@ describe('store user actions', () => {
       expect(localStorage.setItem).toHaveBeenCalledWith(LS_HIDDEN_USERS_KEY, JSON.stringify({}));
     });
   });
+
+  test('signout clears the user when the server refuses the logout', async () => {
+    // signout reloads the comments, which reads the hidden users
+    const store = mockStore({ ...INITIAL_STORE, hiddenUsers: {} });
+    // an expired header token is refused with 403, and the reader still has to end up signed out
+    fetchMock.mockResponseOnce(JSON.stringify({ error: 'logout not allowed' }), { status: 403 });
+
+    await store.dispatch(signout());
+
+    expect(store.getActions()).toContainEqual({ type: USER_SET, user: null });
+  });
 });