From 5f8ac380773d71e72662bdc47be1d7325d0518f5 Mon Sep 17 00:00:00 2001 From: Tamar Weisskopf Date: Thu, 6 Aug 2026 11:39:20 +0300 Subject: [PATCH 1/5] fix: fix logout for cognito --- .../exploitiq/rest/TokenResource.java | 30 +++++++++++++++++-- 1 file changed, 27 insertions(+), 3 deletions(-) diff --git a/src/main/java/com/redhat/ecosystemappeng/exploitiq/rest/TokenResource.java b/src/main/java/com/redhat/ecosystemappeng/exploitiq/rest/TokenResource.java index 6b6b39ab..a85ea19b 100644 --- a/src/main/java/com/redhat/ecosystemappeng/exploitiq/rest/TokenResource.java +++ b/src/main/java/com/redhat/ecosystemappeng/exploitiq/rest/TokenResource.java @@ -24,15 +24,27 @@ import jakarta.ws.rs.core.MediaType; import jakarta.ws.rs.core.Response; +import org.eclipse.microprofile.config.inject.ConfigProperty; import org.eclipse.microprofile.openapi.annotations.Operation; import com.redhat.ecosystemappeng.exploitiq.service.UserService; +import java.net.URI; + @Path("/user") public class TokenResource { @Inject UserService userService; + @ConfigProperty(name = "quarkus.oidc.enabled", defaultValue = "false") + boolean oidcEnabled; + + @ConfigProperty(name = "quarkus.profile") + String quarkusProfile; + + @ConfigProperty(name = "quarkus.oidc.auth-server-url", defaultValue = "") + String authServerUrl; + @GET @Produces("application/json") @Operation(hidden = true) @@ -41,9 +53,9 @@ public String getUserName() { } /** - * Performs a local logout using the standard 'Clear-Site-Data' header. - * This feature is available only in secure contexts (HTTPS) - * https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Clear-Site-Data + * Performs logout based on the authentication provider: + * - For AWS Cognito: redirects to /logout endpoint to trigger Cognito logout + * - For Keycloak and OpenShift OAuth: uses Clear-Site-Data header */ @POST @Path("/logout") @@ -51,6 +63,18 @@ public String getUserName() { @Operation(hidden = true) @PermitAll public Response logout() { + // Check if this is AWS Cognito by looking at the auth-server-url + boolean isCognito = oidcEnabled && + "external-idp".equals(quarkusProfile) && + authServerUrl.contains("cognito-idp.") && + authServerUrl.contains(".amazonaws.com"); + + // For Cognito, redirect to the Quarkus OIDC logout endpoint which handles Cognito logout + if (isCognito) { + return Response.seeOther(URI.create("/logout")).build(); + } + + // For Keycloak, OpenShift OAuth, or no external IDP: use local logout with Clear-Site-Data return Response.ok(LOGGED_OUT_HTML) .header("Clear-Site-Data", "\"cookies\", \"storage\"") .build(); From e57124167fc32fb8f9441acf200e891aeabfe6c9 Mon Sep 17 00:00:00 2001 From: Tamar Weisskopf Date: Thu, 6 Aug 2026 12:16:20 +0300 Subject: [PATCH 2/5] fix: fix logout for cognito --- .../ecosystemappeng/exploitiq/rest/TokenResource.java | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/src/main/java/com/redhat/ecosystemappeng/exploitiq/rest/TokenResource.java b/src/main/java/com/redhat/ecosystemappeng/exploitiq/rest/TokenResource.java index a85ea19b..313a9c60 100644 --- a/src/main/java/com/redhat/ecosystemappeng/exploitiq/rest/TokenResource.java +++ b/src/main/java/com/redhat/ecosystemappeng/exploitiq/rest/TokenResource.java @@ -29,6 +29,7 @@ import com.redhat.ecosystemappeng.exploitiq.service.UserService; import java.net.URI; +import java.util.Optional; @Path("/user") public class TokenResource { @@ -42,8 +43,8 @@ public class TokenResource { @ConfigProperty(name = "quarkus.profile") String quarkusProfile; - @ConfigProperty(name = "quarkus.oidc.auth-server-url", defaultValue = "") - String authServerUrl; + @ConfigProperty(name = "quarkus.oidc.auth-server-url") + Optional authServerUrl; @GET @Produces("application/json") @@ -66,8 +67,9 @@ public Response logout() { // Check if this is AWS Cognito by looking at the auth-server-url boolean isCognito = oidcEnabled && "external-idp".equals(quarkusProfile) && - authServerUrl.contains("cognito-idp.") && - authServerUrl.contains(".amazonaws.com"); + authServerUrl.isPresent() && + authServerUrl.get().contains("cognito-idp.") && + authServerUrl.get().contains(".amazonaws.com"); // For Cognito, redirect to the Quarkus OIDC logout endpoint which handles Cognito logout if (isCognito) { From 7b8735df2aada0c8729d854469c1040b164d3c6b Mon Sep 17 00:00:00 2001 From: Tamar Weisskopf Date: Thu, 6 Aug 2026 14:10:16 +0300 Subject: [PATCH 3/5] fix: use absolute path for Cognito logout redirect --- .../redhat/ecosystemappeng/exploitiq/rest/TokenResource.java | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/main/java/com/redhat/ecosystemappeng/exploitiq/rest/TokenResource.java b/src/main/java/com/redhat/ecosystemappeng/exploitiq/rest/TokenResource.java index 313a9c60..0c9c34ec 100644 --- a/src/main/java/com/redhat/ecosystemappeng/exploitiq/rest/TokenResource.java +++ b/src/main/java/com/redhat/ecosystemappeng/exploitiq/rest/TokenResource.java @@ -73,7 +73,7 @@ public Response logout() { // For Cognito, redirect to the Quarkus OIDC logout endpoint which handles Cognito logout if (isCognito) { - return Response.seeOther(URI.create("/logout")).build(); + return Response.temporaryRedirect(URI.create("/q/oidc/logout")).build(); } // For Keycloak, OpenShift OAuth, or no external IDP: use local logout with Clear-Site-Data From c51638c634336864cd022694101fed57bd2aa771 Mon Sep 17 00:00:00 2001 From: Tamar Weisskopf Date: Thu, 6 Aug 2026 14:41:48 +0300 Subject: [PATCH 4/5] fix: build absolute URI for Cognito logout redirect Use UriInfo to construct absolute logout URI instead of relative path. This prevents /q/oidc/logout from resolving to /api/v1/q/oidc/logout. --- .../ecosystemappeng/exploitiq/rest/TokenResource.java | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/src/main/java/com/redhat/ecosystemappeng/exploitiq/rest/TokenResource.java b/src/main/java/com/redhat/ecosystemappeng/exploitiq/rest/TokenResource.java index 0c9c34ec..1b8e1160 100644 --- a/src/main/java/com/redhat/ecosystemappeng/exploitiq/rest/TokenResource.java +++ b/src/main/java/com/redhat/ecosystemappeng/exploitiq/rest/TokenResource.java @@ -21,8 +21,10 @@ import jakarta.ws.rs.POST; import jakarta.ws.rs.Path; import jakarta.ws.rs.Produces; +import jakarta.ws.rs.core.Context; import jakarta.ws.rs.core.MediaType; import jakarta.ws.rs.core.Response; +import jakarta.ws.rs.core.UriInfo; import org.eclipse.microprofile.config.inject.ConfigProperty; import org.eclipse.microprofile.openapi.annotations.Operation; @@ -63,7 +65,7 @@ public String getUserName() { @Produces(MediaType.TEXT_HTML) @Operation(hidden = true) @PermitAll - public Response logout() { + public Response logout(@Context UriInfo uriInfo) { // Check if this is AWS Cognito by looking at the auth-server-url boolean isCognito = oidcEnabled && "external-idp".equals(quarkusProfile) && @@ -73,7 +75,11 @@ public Response logout() { // For Cognito, redirect to the Quarkus OIDC logout endpoint which handles Cognito logout if (isCognito) { - return Response.temporaryRedirect(URI.create("/q/oidc/logout")).build(); + // Build absolute URI to avoid relative path resolution issues + URI logoutUri = uriInfo.getBaseUriBuilder() + .replacePath("/q/oidc/logout") + .build(); + return Response.temporaryRedirect(logoutUri).build(); } // For Keycloak, OpenShift OAuth, or no external IDP: use local logout with Clear-Site-Data From 3f99a4a71ee15a67371c3333ffe0e43089871035 Mon Sep 17 00:00:00 2001 From: Tamar Weisskopf Date: Thu, 6 Aug 2026 15:18:57 +0300 Subject: [PATCH 5/5] fix: use Clear-Site-Data for logout on all auth providers Simplified logout to use Clear-Site-Data header for all OIDC providers. Clearing cookies is sufficient - no need for provider-specific redirects. Also renamed permission to 'auth-logout' for proper evaluation order. --- .../exploitiq/rest/TokenResource.java | 35 ++----------------- src/main/resources/application.properties | 5 +-- 2 files changed, 6 insertions(+), 34 deletions(-) diff --git a/src/main/java/com/redhat/ecosystemappeng/exploitiq/rest/TokenResource.java b/src/main/java/com/redhat/ecosystemappeng/exploitiq/rest/TokenResource.java index 1b8e1160..d1f6a8ac 100644 --- a/src/main/java/com/redhat/ecosystemappeng/exploitiq/rest/TokenResource.java +++ b/src/main/java/com/redhat/ecosystemappeng/exploitiq/rest/TokenResource.java @@ -21,32 +21,18 @@ import jakarta.ws.rs.POST; import jakarta.ws.rs.Path; import jakarta.ws.rs.Produces; -import jakarta.ws.rs.core.Context; import jakarta.ws.rs.core.MediaType; import jakarta.ws.rs.core.Response; -import jakarta.ws.rs.core.UriInfo; -import org.eclipse.microprofile.config.inject.ConfigProperty; import org.eclipse.microprofile.openapi.annotations.Operation; import com.redhat.ecosystemappeng.exploitiq.service.UserService; -import java.net.URI; -import java.util.Optional; - @Path("/user") public class TokenResource { @Inject UserService userService; - @ConfigProperty(name = "quarkus.oidc.enabled", defaultValue = "false") - boolean oidcEnabled; - - @ConfigProperty(name = "quarkus.profile") - String quarkusProfile; - - @ConfigProperty(name = "quarkus.oidc.auth-server-url") - Optional authServerUrl; @GET @Produces("application/json") @@ -65,24 +51,9 @@ public String getUserName() { @Produces(MediaType.TEXT_HTML) @Operation(hidden = true) @PermitAll - public Response logout(@Context UriInfo uriInfo) { - // Check if this is AWS Cognito by looking at the auth-server-url - boolean isCognito = oidcEnabled && - "external-idp".equals(quarkusProfile) && - authServerUrl.isPresent() && - authServerUrl.get().contains("cognito-idp.") && - authServerUrl.get().contains(".amazonaws.com"); - - // For Cognito, redirect to the Quarkus OIDC logout endpoint which handles Cognito logout - if (isCognito) { - // Build absolute URI to avoid relative path resolution issues - URI logoutUri = uriInfo.getBaseUriBuilder() - .replacePath("/q/oidc/logout") - .build(); - return Response.temporaryRedirect(logoutUri).build(); - } - - // For Keycloak, OpenShift OAuth, or no external IDP: use local logout with Clear-Site-Data + public Response logout() { + // Use Clear-Site-Data header to clear cookies and storage + // Works for all OIDC providers (Cognito, Keycloak, OpenShift OAuth) return Response.ok(LOGGED_OUT_HTML) .header("Clear-Site-Data", "\"cookies\", \"storage\"") .build(); diff --git a/src/main/resources/application.properties b/src/main/resources/application.properties index a90ddb19..8451450a 100644 --- a/src/main/resources/application.properties +++ b/src/main/resources/application.properties @@ -142,8 +142,9 @@ quarkus.oidc.authentication.java-script-auto-redirect=false # ============================================================================== # Allow logout for all authenticated users (even without roles) -quarkus.http.auth.permission.logout.paths=/api/v1/user/logout -quarkus.http.auth.permission.logout.policy=permit +# Named "auth-logout" to be processed before "default" permission (alphabetical order) +quarkus.http.auth.permission.auth-logout.paths=/api/v1/user/logout,/q/oidc/logout +quarkus.http.auth.permission.auth-logout.policy=permit # Allow health endpoints (for monitoring)