Don't use "/logout" as the next-url for login

[nedbat]

If /logout is the current page, redirecting back there after logging in
makes the whole exercise pointless.

[edx-status-bot]

Your PR has finished running tests. There were no failures.

[nedbat]

@kdmccormick @cpennington Is there a reasonable place to put a test? Is it needed?

[kdmccormick]

@nedbat Since we ripped out bokchoy, I don't think there's an obvious way to test templates. So if you go this route, then no, don't bother testing it.

You could also put the change deeper in the backend: all LMS 'next' params go through is_safe_login_or_logout_redirect. Doing the validation there would stop this from popping up on the eventual MFE login/logout page.

[nedbat]

I'd want to understand it a little better, but at a first look, is_safe_login_or_logout_redirect doesn't seem right: if it rejects "/logout", its caller will log a warning message about an unsafe redirect. That would add a lot of misleading noise to the logs.

[kdmccormick]

if it rejects "/logout", its caller will log a warning message about an unsafe redirect. That would add a lot of misleading noise to the logs.

Good point. And I could see it argued that this is more of a front-end concern, anyway: there's nothing wrong or unsafe about redirecting to /logout, it's just bad UX.

Anyway, thanks for fixing this, LGTM 👍

[edx-pipeline-bot]

EdX Release Notice: This PR has been deployed to the staging environment in preparation for a release to production.

[edx-pipeline-bot]

EdX Release Notice: This PR has been deployed to the production environment.