fix: implement custom Cognito logout to use correct parameters - #299
fix: implement custom Cognito logout to use correct parameters#299TamarW0 wants to merge 10 commits into
Conversation
Quarkus OIDC's built-in logout sends id_token_hint and post_logout_redirect_uri, but AWS Cognito requires client_id and logout_uri parameters instead.
✅ Snyk checks have passed. No issues have been found so far.
💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse. |
|
/test exploit-iq-client-on-pr |
|
/test exploit-iq-client-on-pr |
|
/test exploit-iq-client-on-pr |
zvigrinberg
left a comment
zvigrinberg
left a comment
There was a problem hiding this comment.
Hi Tamar,
Please see my comments.
|
/test exploit-iq-client-on-pr |
| // Build logout redirect URI (application root, not API base) | ||
| // uriInfo.getBaseUri() returns https://host/api/v1/, we need https://host/ | ||
| URI baseUri = uriInfo.getBaseUri(); | ||
| String logoutRedirectUri = baseUri.getScheme() + "://" + baseUri.getAuthority() + "/"; |
There was a problem hiding this comment.
@TamarW0 UX issue ( chances are that QE will notice this behavior change in cognito vs. other Idps immediately) - it redirects to login in cognito immediately, without going through the LOGGED_OUT_HTML.
To resolve it, you can just go through a new GET endpoint path that cognito will call, and it will route to the LOGGED_OUT_HTML, which in turn , when pressing on the Login again button will redirect to /, so it will route to cognito for authentication
| String logoutRedirectUri = baseUri.getScheme() + "://" + baseUri.getAuthority() + "/"; | |
| String logoutRedirectUri = baseUri.getScheme() + "://" + baseUri.getAuthority() + "/api/v1/user/logged-out"; |
New endpoint:
@GET
@Path("/logged-out")
@Produces(MediaType.TEXT_HTML)
@Operation(hidden = true)
@PermitAll
public Response loggedOut() {
return buildLogoutResponse(Response.ok(LOGGED_OUT_HTML));- Invalidate OIDC session server-side before logout redirect - Add /logged-out endpoint to display success page after Cognito logout - Change Cognito redirect from / to /api/v1/user/logged-out
|
/test exploit-iq-client-on-pr |
|
/test exploit-iq-client-on-pr |
|
/test exploit-iq-client-on-pr |
|
/test exploit-iq-client-on-pr |
3 participants
Quarkus OIDC's built-in logout sends id_token_hint and post_logout_redirect_uri,
but AWS Cognito requires client_id and logout_uri parameters instead.