Implements OIDC RP-Initiated Logout

[krjakbrjak]

At logout time, if the user authenticated via OIDC, we look up the provider's end_session_endpoint (already discovered by Goth from the OIDC metadata) and redirect there with client_id and post_logout_redirect_uri. No database changes, no token storage.

Non-OIDC OAuth2 providers (GitHub, GitLab, etc.) are unaffected — they fall back to local-only logout.

Setup (IdP side)

Add Gitea's URL to the client's Valid post logout redirect URIs in your IdP config (e.g. https://gitea.example.com/).

Solves #14270
gitea-oidc-logout.webm

[lunny]

It looks like this code may be duplicated from #30072.

[krjakbrjak]

It looks like this code may be duplicated from #30072.

Thanks for the note @lunny ! I'm aware of #30072 but my implementation takes a deliberately lighter approach. #30072 uses id_token_hint, which requires a new database model (ExternalAuthToken), migrations, and session-level token tracking — that's why it's an XL-sized PR. My PR instead uses the client_id parameter (which the RP-Initiated Logout spec also supports), which means zero database changes, zero token storage, and much less changes. The code isn't derived from #30072 — the implementations share essentially no logic beyond what the OIDC spec itself requires. I needed something that works without db changes and is applicable on top of any gitea release. this is what I am using in a production so far, but thought it would be great to have it finally as a part of gitea. Is there anything I can do to help move this forward?

[Copilot]

Pull request overview

This pull request implements OIDC RP-Initiated Logout functionality for Gitea, allowing users who authenticated via an OIDC provider to be properly logged out from both Gitea and the identity provider. The implementation discovers the provider's end_session_endpoint from the OIDC metadata and redirects to it with the appropriate parameters (client_id and post_logout_redirect_uri). Non-OIDC OAuth2 providers fall back to local-only logout, maintaining backward compatibility.

Changes:

• Added frontend logic to handle external URL redirects for OIDC logout endpoints
• Implemented backend function to retrieve OIDC end session endpoint from provider metadata
• Integrated OIDC logout into the sign-out flow with fallback to local logout

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated no comments.

File	Description
web_src/js/features/common-fetch-action.ts	Adds external URL detection and direct navigation to bypass same-site restriction for OIDC logout redirects
services/auth/source/oauth2/providers.go	Implements GetOIDCEndSessionEndpoint to retrieve the OIDC end session endpoint from provider configuration
routers/web/auth/oauth.go	Adds buildOIDCEndSessionURL to construct the OIDC logout URL with required parameters
routers/web/auth/auth.go	Modifies SignOut to check for OIDC logout and redirect to end session endpoint before local logout

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[wxiaoguang]

My PR instead uses the client_id parameter (which the RP-Initiated Logout spec also supports)

Can you add the spec reference as code comment?

[krjakbrjak]

@wxiaoguang Thanks for the refactoring! Could you share what was wrong with the original approach?

Also, one thing I noticed: if the user is OAuth2 but the provider is not OIDC (e.g. GitHub), buildOIDCEndSessionURL returns "", which overwrites the default. Should this be:

if ctx.Doer != nil && ctx.Doer.LoginType == auth.OAuth2 {
    if builtUrl := buildOIDCEndSessionURL(ctx, ctx.Doer); builtUrl != "" {
        redirectTo = builtUrl
    }
}

btw, switching from Post to Get requires some adjustments in the tests, currently TestSignOut is failing because of that.

[krjakbrjak]

My PR instead uses the client_id parameter (which the RP-Initiated Logout spec also supports)

Can you add the spec reference as code comment?

Added

[wxiaoguang]

Thanks for the refactoring! Could you share what was wrong with the original approach?

The JS doesn't need to change. "GET" is the right approach, the same as GitHub.

Also, one thing I noticed: if the user is OAuth2 but the provider is not OIDC (e.g. GitHub), buildOIDCEndSessionURL returns "", which overwrites the default. Should this be:

Sorry, I made a mistake, fixed in new commits and added a new "assert"

[wxiaoguang]

Will try to add more tests

[wxiaoguang]

Hopefully it is good enough now.

It's really tricky to write a test for the new endpoint .....