signOut: clear TokenManager and provide options for revoke and redirect #288
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
swiftone
reviewed
Nov 19, 2019
swiftone
reviewed
Nov 19, 2019
swiftone
reviewed
Nov 19, 2019
swiftone
reviewed
Nov 19, 2019
swiftone
reviewed
Nov 19, 2019
swiftone
reviewed
Nov 19, 2019
swiftone
reviewed
Nov 19, 2019
swiftone
reviewed
Nov 19, 2019
swiftone
reviewed
Nov 19, 2019
robertjd
reviewed
Nov 20, 2019
swiftone
approved these changes
Nov 21, 2019
robertjd
reviewed
Nov 21, 2019
robertjd
reviewed
Nov 25, 2019
aarongranick-okta
force-pushed
the
ag-logout-redirect-OKTA-228271
branch
from
dd8cef2
to
5591a94
Compare
swiftone
reviewed
Nov 26, 2019
README.md
Outdated
| * Will change the `window.location` to an Okta-hosted page before redirecting to a URI of your choice. | ||
| * No issue with 3rd-party cookies. | ||
| * Requires a `postLogoutRedirectUri` to be specified. This URI must be whitelisted in the Okta application's settings. | ||
| * Requires a valid `idToken`. If the `idToken` is invalid or session does not exist the redirect may end on a 400 error page from Okta. This error will be visible to the user and cannot be handled by the app. |
There was a problem hiding this comment.
Is this true? I thought only a non-whitelisted post_logout_redirect_uri gave errors
There was a problem hiding this comment.
Yeah, good catch. I see that an invalid session does not produce an error. I'll see if I can suss out any other error conditions.
There was a problem hiding this comment.
Documentation here lists some error conditions (including invalid id_token), I'll try to repro: https://developer.okta.com/docs/reference/api/oidc/#error-conditions
aarongranick-okta
changed the title
aarongranick-okta
force-pushed
the
ag-logout-redirect-OKTA-228271
branch
from
a009e42
to
482d898
Compare
1 task
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Current behavior is preserved with default options
Passing a
postLogoutRedirectUriwill use post logout redirect flowAutomatically reads idToken from TokenManager
Can manually specify idToken for advanced/custom scenarios
If
postLogoutRedirectUriis specified, redirect logic will happen even if idToken is not availableClears TokenManager on signOut. All OIDC sdks have been doing this step before calling signOut. The server-side redirect method requires an idToken, so the TokenManager should not be cleared before calling signOut(). The call to
tokenManager.clear()can be removed from the SDKs once they are using this version.