# LOGOUT buttom does not logout from superuser, redirects to space\_selector and not redirects to login\_page **URL:** \ **Category:** Kibana\ **Tags:** elastic-stack-security\ **Created:** [February 25, 2020, 11:28am UTC](https://discuss.elastic.co/t/logout-buttom-does-not-logout-from-superuser-redirects-to-space-selector-and-not-redirects-to-login-page/220837 "2020-02-25T11:28:19Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![MARCO\_RAMBALDI](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marco_rambaldi/32/46108_2.png) [@MARCO\_RAMBALDI](https://discuss.elastic.co/u/MARCO_RAMBALDI)\ **Post date:** [February 25, 2020, 11:28am UTC](https://discuss.elastic.co/t/logout-buttom-does-not-logout-from-superuser-redirects-to-space-selector-and-not-redirects-to-login-page/220837/1 "2020-02-25T11:28:19Z")
Hi! I have a basic license. When i deployed the stack i used NGINX to have a basic auth and a web server/proxy. Now I have just deployed the xpack security using native realm to have a basic auth with different users. I created 2 new users different from the superuser (that of nginx). Now that i have both, when i try to click on LOGOUT to select a different account from the superuser, kibana superuser does not logout and kibana redirects to space\_selector...why?? Someone can help me? I think that there is a conflict between x-pack security and nginx. Maybe nginx does not logout, the x-pack is still seeing the superuser signed in and does not logout. ---
**Author:** ![joshdover](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/joshdover/32/42020_2.png) [@joshdover](https://discuss.elastic.co/u/joshdover)\ **Post date:** [February 25, 2020, 7:55pm UTC](https://discuss.elastic.co/t/logout-buttom-does-not-logout-from-superuser-redirects-to-space-selector-and-not-redirects-to-login-page/220837/2 "2020-02-25T19:55:28Z")
> I think that there is a conflict between x-pack security and nginx. Maybe nginx does not logout, the x-pack is still seeing the superuser signed in and does not logout. This sounds right. If your nginx is configured to add the `Authentication` header on every request, then you will not be able to actually log out completely from the client. You will most likely need to remove the headers for the super user. ---
**Author:** ![MARCO\_RAMBALDI](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marco_rambaldi/32/46108_2.png) [@MARCO\_RAMBALDI](https://discuss.elastic.co/u/MARCO_RAMBALDI)\ **Post date:** [February 26, 2020, 11:25am UTC](https://discuss.elastic.co/t/logout-buttom-does-not-logout-from-superuser-redirects-to-space-selector-and-not-redirects-to-login-page/220837/3 "2020-02-26T11:25:42Z")
Ok @joshdover! Thanks to confirm my idea. But how can i trigger the elimination of `Authentication` header when i click on Logout? Or do you think i have to remove the nginx authentication and keep only the proxy/web server function? Is it possible? ---
**Author:** ![joshdover](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/joshdover/32/42020_2.png) [@joshdover](https://discuss.elastic.co/u/joshdover)\ **Post date:** [February 26, 2020, 5:11pm UTC](https://discuss.elastic.co/t/logout-buttom-does-not-logout-from-superuser-redirects-to-space-selector-and-not-redirects-to-login-page/220837/4 "2020-02-26T17:11:16Z")
If you have the included security enabled, I see no reason to keep the nginx authentication header, nor do I know of how to make nginx omit this header in some cases. It's probably quite dangerous to be allow any user to have superuser access since you now have native security set up. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [March 25, 2020, 5:11pm UTC](https://discuss.elastic.co/t/logout-buttom-does-not-logout-from-superuser-redirects-to-space-selector-and-not-redirects-to-login-page/220837/5 "2020-03-25T17:11:18Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.