[v10][post-logout]: we can't redirect to other url than the origine one

[laurentC35]

Here you do some string operation (with slice) on result of rootRelativePostLogoutRedirectUrl: https://github.com/keycloakify/oidc-spa/blob/main/src/core/createOidc.ts#L1554

So we lost the feature that enable to logout on other domain than the origin one with "specific url"

example:

• current url : "https://my-questionnaire.test.fr"
• specificUrlParam for logout : "https://portail-questionnaire.test.fr/deconnexion" (business need)

The result of rootRelativePostLogoutRedirectUrl will be : 'st.fr/deconnexion' instead of "https://portail-questionnaire.test.fr/deconnexion" as expected

[garronej]

Thank you for reporting @laurentC35,

That's very infortunate :(

I didn't anticipate that you might want to redirect outside of the app.

I'll fix it.

[laurentC35]

@garronej

If the oidc-spa library hasn't been designated to output outside the app, I could consider creating a page like "/logout?redirect-logout-url=https://my-other-app.example.com" which would then simply redirect to where I want it.

What do you think?

[garronej]

I mean if you could do that it would save a painful refactor...

But I don't know maybe I should support this usecase. I can't tell how specific it is to your app. 🤔

[laurentC35]

So I'll do that and save you the refactoring.

I'm just wondering about the oidc spec about the "post_logout_redirect_uri" params.

Thanks for your reply.
I can close the issue if it's okay for you

[garronej]

I'm just wondering about the oidc spec about the "post_logout_redirect_uri" params.

This is out of the OIDC spec anyway. With oidc-spa the redirect uri is always the root of the application it's unique and non configurable.

The fact that I block redirecting away is just a bad internal call because I didn't forsee the usecase.

[just-be-weird]

We also ran in similar situation and had to rely on redirect method as suggested by @laurentC35

[garronej]

Ok well, if there is two report I'll def fix it.

[yohoji]

We also ran in similar situation and had to rely on redirect method as suggested by @laurentC35

I did the same