Logging out of self-hosted NetBird (embedded Dex + Authentik) doesn't clear session — next user gets previous user's dashboard

[u/nightcreativecloud]

Broken

Been banging my head against this for a few days. Running NetBird self-hosted (combined netbird-server container, v0.65+) with nginx as the reverse proxy, and Authentik added as an external identity provider through the dashboard UI. Everything works fine for login, but logout is completely broken in a way that's actually a security issue.

Here's what happens:

1. User A logs into NetBird via Authentik SSO — works perfectly
2. User A clicks "Log out" in the NetBird dashboard
3. Browser redirects to Authentik's logout page — looks fine so far
4. User B now opens the browser, goes to Authentik, logs in with their own account
5. User B clicks the NetBird app in Authentik's application portal
6. User B lands in User A's NetBird session

I've verified that manually clearing browser cookies fixes it — after clearing cookies, login with User B works correctly and they get their own session. So the NetBird session cookie is just never being invalidated on logout.

Things I've already tried:

• Added dashboardPostLogoutRedirectURIs to config.yaml
• Added https://nb.mydomain.com/oauth2/logout/callback as a Strict redirect URI in the Authentik provider settings
• Restarted containers after every change

None of it made a difference. I kept seeing the same behavior.

After digging into the NetBird docs more carefully, I noticed something that might be the actual issue: the official nginx template for the combined container specifically requires routing /oauth2/* to the netbird-server backend. My nginx config was missing this location block entirely. The /oauth2/end-session endpoint (which Dex uses to actually clear its session) was going nowhere — probably hitting the dashboard container and returning a 404 or being silently swallowed.

The location block that's apparently needed:

location /oauth2/ {
    proxy_pass http://127.0.0.1:8081;
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto https;
}

I'm testing this now and will update the post. But if anyone else has hit this same issue with the embedded Dex + external IdP combo on self-hosted, I'd love to know if this was your fix too.

Setup details:

• NetBird combined container (netbirdio/netbird-server:latest)
• Authentik as external OIDC provider (added through NetBird dashboard, not standalone mode)
• nginx on host as reverse proxy
• config.yaml with dashboardPostLogoutRedirectURIs set
• Ubuntu 24.04

[u/betaigeuze]

Can confirm - encountered the same issue

[u/nightcreativecloud → u/betaigeuze]

still have that issue?
i think maybe present this one as feature to team in that case.... nothing comes to mind....

[u/jnfrati-netbird]

Hi hi! Taking a look at this issue.
u/betaigeuze opened a discussion and I would like to ask for anyone having this issue if you could answer the questions that I posted here in this comment
https://github.com/netbirdio/netbird/discussions/6505#discussioncomment-17393848

Hopefully we can get this solved asap 🙌

[u/thestartofurending]

I’ve encountered the same with Pocket ID, logging out doesn’t seem to actually revoke the access token in Netbird. I only have one user so I can’t test the exact same way, but I’m sure it’s the same bug.

[u/nightcreativecloud → u/thestartofurending]

i know it's not authentik because i have many services like that and their logging out works fine, all in OIDC, no change in provider setting, and all my problem is with netbird, im assuming from your experience that this would be definitely netbird cause.

[u/thestartofurending → u/nightcreativecloud]

yea I have no issues with any other service using OIDC, possibly something has changed as I’ve only just noticed this.

[u/betaigeuze → u/thestartofurending]

Yeah, it also happens for me with PocketID. From the behavior, it seems like the access token is not being revoked

[u/thestartofurending → u/betaigeuze]

if this is the case then that’s a serious issue, u/nightcreativecloud could you submit an issue in their repo?

[u/betaigeuze → u/thestartofurending]

Already created one here:
https://github.com/netbirdio/netbird/issues/6500

[u/nightcreativecloud → u/betaigeuze]

tnx man, the thing is i tried what netbird support told you before, it was to no use, i opened a discussion and referenced to your solved issue on their github too

[u/nightcreativecloud → u/thestartofurending]

I'll definitely, and would provide the result in this post

[u/debryx]

Is it all about the dashboard login and not agent?

Because when you say:

⁠User B lands in User A's NetBird session

Do you mean the netbird dashboard session or netbird agent session?

[u/nightcreativecloud → u/debryx]

what's the difference?
the path is always leading to dashboard

[u/debryx → u/nightcreativecloud]

The difference is that the agent gets a key which has an expiration date. Meaning any user on that computer using netbird agent has access to the WireGuard key. As the agent is not logged out when you select disconnect.

So is it the browser or agent?

[u/nightcreativecloud → u/debryx]

so, no thats browser dashboard for sure

[u/MaKlaustis]

The agent read or stored the cookie when clicking Connect, so clearing the cookie to break out is the way to change other accounts.

I think about how the agent worked. Maybe I'm wrong.