Wordpress Frontend user/Customer logging out of WordPress WooCommerce get a nginx auth

So currently I have the basic auth enabled to protect wp-login which is great.

Code:

location ~* ${WPSUBDIR}/(wp-login\.php) {
    limit_req zone=xwplogin burst=1 nodelay;
    #limit_conn xwpconlimit 30;
    auth_basic "Private";
    auth_basic_user_file /home/nginx/domains/$vhostname/htpasswd_wplogin; 
    include /usr/local/nginx/conf/php-wpsc.conf;
    ${MULTIPHP_INCLUDES}
    # https://community.centminmod.com/posts/18828/
    #include /usr/local/nginx/conf/php-rediscache.conf;
}

The issue I have is that any frontend users and/or WooCommerce customers get redirected to wp-login.php upon logging out - which triggers the basic auth dialog.

Code:

https://www.mydomain.com/wp-login.php?action=logout&redirect_to=https%3A%2F%2Fwww.mydomain.com%2Fmy-account%2F&_wpnonce=noncegoeshere

I can have my cake and eat it by changing the default log out url as follows:

PHP:

add_filter( 'logout_url', 'custom_logout_url', 10, 2 );
add_action( 'wp_loaded', 'custom_logout_action' );

/**
 * Replace default log-out URL.
 *
 * @wp-hook logout_url
 * @param   string $logout_url
 * @param   string $redirect
 * @return  string
 */
function custom_logout_url( $logout_url, $redirect )
{
    $url = add_query_arg( 'logout', 1, home_url( '/' ) );

    if ( ! empty ( $redirect ) )
        $url = add_query_arg( 'redirect', $redirect, $url );

    return $url;
}

/**
 * Log the user out.
 *
 * @wp-hook wp_loaded
 * @return  void
 */
function custom_logout_action()
{
    if ( ! isset ( $_GET['logout'] ) )
        return;

    wp_logout();

    $loc = isset ( $_GET['redirect'] ) ? $_GET['redirect'] : home_url( '/' );
    wp_redirect( $loc );
    exit;
}

But I thought I'd report this in case other WordPress/WooCommerce users are running into this issue.

I wonder if the nginx rule could be made a bit cleverer to stop direct access, but still allow any requests through that contain any action=logout or redirect_to parameters?

---

ChatGPT has suggested this potential enhancement, but I'm wondering if that might introduce some vulnerabilities that I'm not consdering?

Code:

location ~* /(wp-login\.php) {
    # Check if the request includes 'action=logout' parameter
    if ($arg_action = "logout") {
        # Bypass auth and rate limiting for logout action
        # Include necessary PHP configuration for processing the request
        include /usr/local/nginx/conf/php-rediscache.conf;
        break;
    }

    # Apply auth and rate limiting for other requests
    limit_req zone=xwplogin burst=1 nodelay;
    #limit_conn xwpconlimit 30;
    auth_basic "Private";
    auth_basic_user_file /home/nginx/domains/commercegurus.com/htpasswd_wplogin;   
    #include /usr/local/nginx/conf/php-wpsc.conf;

    # PHP configuration for caching, etc.
    include /usr/local/nginx/conf/php-rediscache.conf;
}