http: logout — 303 to end_session_endpoint with id_token_hint for OIDC sessions

2026-05-05 13:34:47 +01:00
parent 1fd9dce8a2
commit d2ffc98f3c
3 changed files with 96 additions and 6 deletions
@@ -200,3 +200,65 @@ func TestOIDCCallbackReturningUserRefreshesRole(t *testing.T) {
 		t.Errorf("role refresh: got %q want admin", u.Role)
 	}
 }
+
+func TestOIDCLogoutRedirectsToEndSession(t *testing.T) {
+	t.Parallel()
+	srv, ts, stub := newTestServerWithOIDC(t)
+	endSessionURL := stub.URL() + "/logout-end"
+	stub.SetEndSessionEndpoint(endSessionURL)
+
+	// Rebuild the OIDC client because end_session_endpoint is read at
+	// New() time from the discovery doc.
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+	cfg := &config.OIDCConfig{
+		Issuer: stub.URL(), ClientID: "test-client", ClientSecret: "x",
+		Scopes: []string{"openid"}, RoleClaim: "groups",
+		RoleMapping: map[string]string{"rm-admins": "admin"},
+	}
+	newClient, err := oidc.New(ctx, cfg, "http://test")
+	if err != nil {
+		t.Fatalf("rebuild client: %v", err)
+	}
+	srv.deps.OIDC = newClient
+
+	// Sign in via the OIDC flow.
+	res := runCallback(t, ts, stub, map[string]any{
+		"sub":                "logout-sub",
+		"preferred_username": "lo",
+		"groups":             []string{"rm-admins"},
+		"aud":                "test-client",
+	})
+	res.Body.Close()
+	cookies := res.Cookies()
+	if len(cookies) == 0 {
+		t.Fatal("expected session cookie after sign-in")
+	}
+	sessionCookie := cookies[0]
+
+	// POST /logout — should 303 to the end_session endpoint with
+	// id_token_hint + post_logout_redirect_uri.
+	c := &stdhttp.Client{CheckRedirect: func(*stdhttp.Request, []*stdhttp.Request) error {
+		return stdhttp.ErrUseLastResponse
+	}}
+	req, _ := stdhttp.NewRequest("POST", ts.URL+"/logout", nil)
+	req.AddCookie(sessionCookie)
+	res, err = c.Do(req)
+	if err != nil {
+		t.Fatalf("logout: %v", err)
+	}
+	defer res.Body.Close()
+	if res.StatusCode != stdhttp.StatusSeeOther {
+		t.Errorf("status: got %d want 303", res.StatusCode)
+	}
+	loc := res.Header.Get("Location")
+	if !strings.Contains(loc, "/logout-end") {
+		t.Errorf("location not at end_session: %q", loc)
+	}
+	if !strings.Contains(loc, "id_token_hint=") {
+		t.Errorf("location missing id_token_hint: %q", loc)
+	}
+	if !strings.Contains(loc, "post_logout_redirect_uri=") {
+		t.Errorf("location missing post_logout_redirect_uri: %q", loc)
+	}
+}