Archives/gristlabs_grist-core
1
0
Fork 0
mirror of https://github.com/gristlabs/grist-core.git synced 2026-03-02 04:09:24 +00:00
Code Issues Projects Releases Wiki Activity

OIDC logout: use a fixed post logout redirect uri (#1276)

Browse Source 
Co-authored-by: Jonathan Perret <j-github@jonathanperret.net>
This commit is contained in:
Vincent Viers
2024-10-22 18:03:11 +02:00
committed by GitHub
parent c27f832851
commit c783a4f75e
3 changed files with 18 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
test/server/lib/OIDCConfig.ts
View File

@@ -752,7 +752,7 @@ describe('OIDCConfig', () => {
});
describe('getLogoutRedirectUrl', () => {
const REDIRECT_URL = new URL('http://localhost:8484/docs/signed-out');
const STABLE_LOGOUT_URL = new URL('http://localhost:8484/signed-out');
const URL_RETURNED_BY_CLIENT = 'http://localhost:8484/logout_url_from_issuer';
const ENV_VALUE_GRIST_OIDC_IDP_END_SESSION_ENDPOINT = 'http://localhost:8484/logout';
const FAKE_SESSION = {
@@ -767,7 +767,7 @@ describe('OIDCConfig', () => {
env: {
GRIST_OIDC_IDP_SKIP_END_SESSION_ENDPOINT: 'true',
},
expectedUrl: REDIRECT_URL.href,
expectedUrl: STABLE_LOGOUT_URL.href,
}, {
itMsg: 'should use the GRIST_OIDC_IDP_END_SESSION_ENDPOINT when it is set',
env: {
@@ -778,14 +778,14 @@ describe('OIDCConfig', () => {
itMsg: 'should call the end session endpoint with the expected parameters',
expectedUrl: URL_RETURNED_BY_CLIENT,
expectedLogoutParams: {
post_logout_redirect_uri: REDIRECT_URL.href,
post_logout_redirect_uri: STABLE_LOGOUT_URL.href,
id_token_hint: FAKE_SESSION.oidc!.idToken,
}
}, {
itMsg: 'should call the end session endpoint with no idToken if session is missing',
expectedUrl: URL_RETURNED_BY_CLIENT,
expectedLogoutParams: {
post_logout_redirect_uri: REDIRECT_URL.href,
post_logout_redirect_uri: STABLE_LOGOUT_URL.href,
id_token_hint: undefined,
},
session: null
@@ -798,9 +798,12 @@ describe('OIDCConfig', () => {
clientStub.endSessionUrl.returns(URL_RETURNED_BY_CLIENT);
const config = await OIDCConfigStubbed.buildWithStub(clientStub.asClient());
const req = {
headers: {
host: STABLE_LOGOUT_URL.host
},
session: 'session' in ctx ? ctx.session : FAKE_SESSION
} as unknown as RequestWithLogin;
const url = await config.getLogoutRedirectUrl(req, REDIRECT_URL);
const url = await config.getLogoutRedirectUrl(req);
assert.equal(url, ctx.expectedUrl);
if (ctx.expectedLogoutParams) {
assert.isTrue(clientStub.endSessionUrl.calledOnce);