Logout (session cookie clear, RP-initiated end-session, 302 back) #28

Merged

ginjiruu merged 4 commits from feat/oidc-logout into master

2026-09-15 17:29:34 +00:00

ginjiruu commented

2026-09-15 04:55:33 +00:00

Owner

Closes #19

Adds the OIDC logout on the :8082 listener (/logout path; the non-/logout path keeps the stub until the callback ticket lands):

Clears the Session cookie (Set-Cookie with Max-Age=0, Path=/) — the App's cookie name when the App resolves by Host, the API default otherwise; never an error status.
EndSession=true (opt-in) with a resolved end_session_endpoint and a readable Session → 302 to the end_session_endpoint with id_token_hint (RP-initiated). EndSession=true with an empty endpoint (discovery-omitted) or no readable Session → 302 back (local-only, per policy).
EndSession=false (default) → clear + 302 back (local-only, zero-config); "back" is the Referer only when same-host (a cross-host Referer must not become an open redirect), else /. The request Host's port is stripped before App resolution so a direct :8082 access still resolves (EndSession is not silently degraded).

Verified TDD-first: 9 tests (default/local with+without Referer, foreign-Referer not-an-open-redirect, Host-with-port still resolves, custom cookie name, RP-initiated with hint, EndSession without endpoint, EndSession without readable session, unknown Host clears the default name, the dispatcher keeps the stub), RED before implementation and GREEN after. Full suite green (-p 1). Two-axis code review: the open-redirect finding was fixed in this branch (same-host Referer gate + regression test) before review sign-off.

Closes #19 Adds the OIDC logout on the `:8082` listener (`/logout` path; the non-`/logout` path keeps the stub until the callback ticket lands): - Clears the Session cookie (`Set-Cookie` with `Max-Age=0`, `Path=/`) — the App's cookie name when the App resolves by Host, the API default otherwise; never an error status. - `EndSession=true` (opt-in) with a resolved `end_session_endpoint` and a readable Session → 302 to the `end_session_endpoint` with `id_token_hint` (RP-initiated). `EndSession=true` with an empty endpoint (discovery-omitted) or no readable Session → 302 back (local-only, per policy). - `EndSession=false` (default) → clear + 302 back (local-only, zero-config); "back" is the Referer only when same-host (a cross-host Referer must not become an open redirect), else `/`. The request Host's port is stripped before App resolution so a direct `:8082` access still resolves (EndSession is not silently degraded). Verified TDD-first: 9 tests (default/local with+without Referer, foreign-Referer not-an-open-redirect, Host-with-port still resolves, custom cookie name, RP-initiated with hint, EndSession without endpoint, EndSession without readable session, unknown Host clears the default name, the dispatcher keeps the stub), RED before implementation and GREEN after. Full suite green (`-p 1`). Two-axis code review: the open-redirect finding was fixed in this branch (same-host Referer gate + regression test) before review sign-off.

ginjiruu added 3 commits

2026-09-15 04:55:33 +00:00

add logout: session cookie clear, rp-initiated end-session, 302 back a9bdeb7ff6

harden logout: same-host referer only, port-stripped app resolution 98ba213b6c

fix logout unknown-host test for the same-host referer gate

Lint / Run on Ubuntu (push) Has been cancelled

Details

Lint / Run on Ubuntu (pull_request) Has been cancelled

Details

E2E Tests / Run on Ubuntu (push) Has been cancelled

Details

E2E Tests / Run on Ubuntu (pull_request) Has been cancelled