Full-chain logout via OIDC RP-initiated logout - #62
Merged
Conversation
Add the plumbing required for RP-initiated logout: persist which provider scheme established a session into the authentication cookie, and add an IEndSessionEndpointResolver that discovers an OIDC provider's end-session endpoint from its OpenID configuration. OAuth 2.0 providers, unknown schemes, and discovery failures resolve to null so callers can fall back to a local-only logout. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Previously /.cratis/logout only cleared the local session, leaving the user signed in at the identity provider so the next visit silently re-authenticated. For an OIDC session the middleware now redirects the browser to the provider's end-session endpoint with id_token_hint and a post_logout_redirect_uri pointing at a new /.cratis/logout/callback, carrying the validated final target across the round-trip in a short-lived HTTP-only cookie; the callback then clears every AuthProxy cookie and redirects to the final target. OAuth 2.0 providers (e.g. GitHub) have no end-session endpoint, so they fall back to the previous local-only logout. The redirect allow-list is validated on both legs and extracted into PostLogoutRedirectPolicy so neither leg can be an open redirect. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Cover the RP-initiated redirect to the end-session endpoint with id_token_hint and post_logout_redirect_uri, the OAuth/no-end-session and no-active-session fallbacks, the post-logout callback clearing cookies and redirecting to the carried target, its open-redirect defense, and the end-session endpoint resolver across OIDC, OAuth, and missing-scheme cases. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Logging out only cleared the local AuthProxy session, leaving the user signed in at the identity provider so the next visit silently re-authenticated.
/.cratis/logoutnow performs a full-chain logout that also ends the session at the provider.Added
/.cratis/logoutnow performs OIDC RP-initiated logout: for a session established through an OIDC provider it redirects the browser to the provider'send_session_endpointwithid_token_hintand apost_logout_redirect_uripointing at the new/.cratis/logout/callback, which then clears every AuthProxy cookie and redirects to the validated final target.Cratis:AuthProxy:...OIDC applications should registerhttps://<proxy-host>/.cratis/logout/callbackas a permitted post-logout redirect URI.Changed
redirecttarget is now validated against the post-logout allow-list on both legs of the round-trip (initiation and callback), and is carried across the identity-provider round-trip in a short-lived HTTP-only cookie rather than in the URL.Documentation/configuration/logout.md.