[LG-7878] Fully remove SP session during unconfirmed OIDC logout#7232
[LG-7878] Fully remove SP session during unconfirmed OIDC logout#7232
Conversation
Resolves LG-7878 changelog: Bug Fixes, Authentication, Remove invalid prompt to send user back to SP during OIDC logout
orenyk
force-pushed
the
oyk-fix-oidc-logout-bug
branch
from
5ec24b2 to
b137b9f
Compare
|
Build failure is a time zone issue - should pass tomorrow |
| } | ||
| @params[:state] = logout_params[:state] if !logout_params[:state].nil? | ||
| @service_provider_name = @logout_form.service_provider&.friendly_name | ||
| delete_branded_experience(logout: true) |
There was a problem hiding this comment.
Should we do this on every branded experience deletion?
There was a problem hiding this comment.
I'm wondering the same. Looking at all the places where this is used and I don't think I see one where that would be inappropriate to remove the sp session.
There was a problem hiding this comment.
The one thing it would potentially break is the sp bounce check which gets stored in the SP session (but we've discussed moving it into the user session)
There was a problem hiding this comment.
@mitchellhenke @jmhooper In the interest of time I'd like to propose keeping this the way it is - leaving delete_branded_experience the same for existing use cases that aren't part of logout requests and additionally clearing the session[:sp] in logout / auth terminating flows. We can have Katherine refactor after the bug is fixed, I'd just rather not touch the sp bounce code since that's not something I'm familiar with. Does that make sense?
3 participants
Resolves LG-7878
🎫 Ticket
https://cm-jira.usa.gov/browse/LG-7878
🛠 Summary of changes
Add an option for
delete_branded_experienceto remove the SP session and use it during OIDC logout to ensure that users that elect not to terminate their Login.gov session don't end up being prompted to return to the SP that logged them out.📜 Testing Plan
Provide a checklist of steps to confirm the changes.
Expected: There will be no alert prompting the user to return to the SP