{% if user.is_authenticated and user.is_superuser and request.archivebox_config.OPENCODE_ENABLED %} {% endif %} {% if user.is_authenticated %} {% block welcome-msg %} {% endblock %} {% block userlinks %} {% if user.has_usable_password %} {% endif %} {% endblock %} {% elif request.COOKIES.archivebox_admin_logged_in == "1" %} {% comment %} Authenticated on the admin host but the session cookie is admin-host- scoped (security boundary — web.* must NEVER see the session). The hint cookie is the only signal that crosses, so we render the logged-out state's `Account` / `Log out` links pointing at admin host so the user can still reach those pages from web.*. NOTE: A cross-host POST+CSRF logout form cannot work here — the CSRF token generated in the web.* context will never match the admin-host- scoped CSRF cookie, causing a 403. Django's LogoutView also rejects GET requests (Django 6+), so we cannot simply link to /admin/logout/. Instead, redirect the user to the admin host where their session lives; they can log out from there using the real, same-host logout form. {% endcomment %} Account / {% trans 'Log out' %} {% else %} {% endif %}