streamlit 1.48.0__py3-none-any.whl → 1.49.0__py3-none-any.whl

streamlit/user_info.py

@@ -100,7 +100,9 @@ def login(provider: str | None = None) -> None:
         - You must install ``Authlib>=1.3.2`` to use this command. You can
           install it as an extra with Streamlit:
 
-          >>> pip install streamlit[auth]
+          .. code-block:: shell
+
+             pip install streamlit[auth]
 
         - Your authentication configuration is dependent on your host location.
           When you deploy your app, remember to update your ``redirect_uri``
@@ -299,18 +301,19 @@ def login(provider: str | None = None) -> None:
 def logout() -> None:
     """Logout the current user.
 
-    This command removes the user's information from ``st.user`` and deletes
-    their Streamlit identity cookie. If the OpenID Connect (OIDC) provider's
-    server metadata includes ``end_session_endpoint``, this command also
-    redirects the user to perform a logout from the identity provider before
-    returning to your app. Otherwise, it only performs a local logout from your
-    app. This creates a new session.
-
-    If the user has multiple sessions open in the same browser, ``st.user``
-    will not be cleared in any other session. ``st.user`` only reads from the
-    identity cookie at the start of a session. After a session is running, you
-    must call ``st.login()`` or ``st.logout()`` within that session to update
-    ``st.user``.
+    This command removes the user's information from ``st.user``,
+    deletes their identity cookie, and redirects them back to your app's home
+    page. This creates a new session.
+
+    If the user has multiple sessions open in the same browser,
+    ``st.user`` will not be cleared in any other session.
+    ``st.user`` only reads from the identity cookie at the start
+    of a session. After a session is running, you must call ``st.login()`` or
+    ``st.logout()`` within that session to update ``st.user``.
+
+    .. Note::
+        This does not log the user out of their underlying account from the
+        identity provider.
 
     Example
     -------

streamlit/web/server/browser_websocket_handler.py

@@ -180,6 +180,21 @@ class BrowserWebSocketHandler(WebSocketHandler, SessionClient):
             # extract it from the Sec-Websocket-Protocol header.
             pass
 
+        # Map in any user-configured headers. Note that these override anything coming
+        # from the auth cookie.
+        mapping_config = config.get_option("server.trustedUserHeaders")
+        for header_name, user_info_key in mapping_config.items():
+            header_values = self.request.headers.get_list(header_name)
+            if header_values:
+                # If there's at least one value, use the first value.
+                # NOTE: Tornado doesn't document the order of these values, so it's
+                # possible this won't be the first value that was received by the
+                # server.
+                user_info[user_info_key] = header_values[0]
+            else:
+                # Default to explicit None.
+                user_info[user_info_key] = None
+
         self._session_id = self._runtime.connect_session(
             client=self,
             user_info=user_info,

streamlit/web/server/oauth_authlib_routes.py

@@ -15,7 +15,7 @@ from __future__ import annotations
 
 import json
 from typing import Any, Final, cast
-from urllib.parse import urlencode, urlparse
+from urllib.parse import urlparse
 
 import tornado.web
 
@@ -130,63 +130,7 @@ class AuthLoginHandler(AuthHandlerMixin, tornado.web.RequestHandler):
 class AuthLogoutHandler(AuthHandlerMixin, tornado.web.RequestHandler):
     def get(self) -> None:
         self.clear_auth_cookie()
-
-        provider_logout_url = self._get_provider_logout_url()
-        if provider_logout_url:
-            self.redirect(provider_logout_url)
-        else:
-            self.redirect_to_base()
-
-    def _get_redirect_root(self) -> str | None:
-        auth_section = get_secrets_auth_section()
-        if not auth_section or not auth_section.get("redirect_uri"):
-            return None
-
-        redirect_uri: str = auth_section["redirect_uri"]
-        if not redirect_uri.endswith("/oauth2callback"):
-            _LOGGER.warning("Redirect URI does not end with /oauth2callback")
-            return None
-
-        return redirect_uri.removesuffix("oauth2callback")
-
-    def _get_provider_logout_url(self) -> str | None:
-        """Get the OAuth provider's logout URL from OIDC metadata."""
-        try:
-            cookie_value = self.get_signed_cookie(AUTH_COOKIE_NAME)
-        except AttributeError:  # Backward compatibility with Tornado < 6.3.0
-            cookie_value = self.get_secure_cookie(AUTH_COOKIE_NAME)
-
-        if not cookie_value:
-            return None
-
-        try:
-            user_info = json.loads(cookie_value)
-            provider = user_info.get("provider")
-            if not provider:
-                return None
-
-            client, _ = create_oauth_client(provider)
-
-            metadata = client.load_server_metadata()
-            end_session_endpoint = metadata.get("end_session_endpoint")
-
-            if not end_session_endpoint:
-                _LOGGER.info("No end_session_endpoint found for provider %s", provider)
-                return None
-
-            redirect_root = self._get_redirect_root()
-            if redirect_root is None:
-                _LOGGER.info("Redirect url could not be determined")
-                return None
-
-            logout_params = {"post_logout_redirect_uri": redirect_root}
-
-            # Not using id_token_hint as we don't store the id token
-            return f"{end_session_endpoint}?{urlencode(logout_params)}"
-
-        except Exception as e:
-            _LOGGER.warning("Failed to get provider logout URL: %s", e)
-            return None
+        self.redirect_to_base()
 
 
 class AuthCallbackHandler(AuthHandlerMixin, tornado.web.RequestHandler):
@@ -228,7 +172,7 @@ class AuthCallbackHandler(AuthHandlerMixin, tornado.web.RequestHandler):
         token = client.authorize_access_token(self)
         user = cast("dict[str, Any]", token.get("userinfo"))
 
-        cookie_value = dict(user, origin=origin, is_logged_in=True, provider=provider)
+        cookie_value = dict(user, origin=origin, is_logged_in=True)
         if user:
             self.set_auth_cookie(cookie_value)
         else:

{streamlit-1.48.0.dist-info → streamlit-1.49.0.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: streamlit
-Version: 1.48.0
+Version: 1.49.0
 Summary: A faster way to build and share data apps
 Home-page: https://streamlit.io
 Author: Snowflake Inc
@@ -52,6 +52,8 @@ Requires-Dist: tornado!=6.5.0,<7,>=6.0.3
 Provides-Extra: snowflake
 Requires-Dist: snowflake-snowpark-python[modin]>=1.17.0; python_version < "3.12" and extra == "snowflake"
 Requires-Dist: snowflake-connector-python>=3.3.0; python_version < "3.12" and extra == "snowflake"
+Provides-Extra: pdf
+Requires-Dist: streamlit-pdf>=1.0.0; extra == "pdf"
 Provides-Extra: auth
 Requires-Dist: Authlib>=1.3.2; extra == "auth"
 Provides-Extra: charts
@@ -62,7 +64,7 @@ Requires-Dist: orjson>=3.5.0; extra == "charts"
 Provides-Extra: sql
 Requires-Dist: SQLAlchemy>=2.0.0; extra == "sql"
 Provides-Extra: all
-Requires-Dist: streamlit[auth,charts,snowflake,sql]; extra == "all"
+Requires-Dist: streamlit[auth,charts,pdf,snowflake,sql]; extra == "all"
 Requires-Dist: rich>=11.0.0; extra == "all"
 Dynamic: author
 Dynamic: author-email