Always require confirmation of user logout in OIDC Logout#12048
Merged
mitchellhenke merged 1 commit intomainfrom Apr 3, 2025
Merged
Always require confirmation of user logout in OIDC Logout#12048mitchellhenke merged 1 commit intomainfrom
mitchellhenke merged 1 commit intomainfrom
Conversation
changelog: Bug Fixes, OpenID Connect, Always require confirmation of user logout
mitchellhenke
force-pushed
the
mitchellhenke/consistent-openid-logout
branch
from
a8c909f to
b09ad0b
Compare
Sgtpluck
reviewed
Apr 3, 2025
| @params = { | ||
| client_id: logout_params[:client_id], | ||
| post_logout_redirect_uri: logout_params[:post_logout_redirect_uri], | ||
| id_token_hint: logout_params[:id_token_hint], |
Contributor
There was a problem hiding this comment.
[question]is there anything to worry about including the id_token_hint in the logout params?
Contributor
Author
There was a problem hiding this comment.
Good catch. It should be ok in the params since they're being submitted as a POST request via a form.
Sgtpluck
approved these changes
Apr 3, 2025
Contributor
Sgtpluck
left a comment
Sgtpluck
left a comment
There was a problem hiding this comment.
code looks good, just a general question about the inclusion of the id_token_hint param
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
🎫 Ticket
Link to the relevant ticket:
!159
🛠 Summary of changes
Following #6936 and #7017, we added support for the OpenID Logout
client_idparameter as a step to deprecating theid_token_hintparameter. Part of the OpenID Connect RP-Initiated Logout 1.0 includes:Currently, we require user confirmation for the former case when the request is not using
id_token_hint, and requests using the deprecatedid_token_hintdo not. This behavior is both inconsistent and does not meet the SHOULD recommendation from the specification.This PR changes the behavior so that users need to confirm they want to be logged out before they are logged out.