webapp/bookstack
1
0
Fork 0
mirror of https://github.com/BookStackApp/BookStack.git synced 2025-07-30 04:23:11 +03:00
Code Activity

OIDC RP Logout: Fixed issues during testing

Browse Source 
- Disabled by default due to strict rejection by auth systems.
- Fixed issue when autoloading logout URL, but not provided in
  autodiscovery response.
- Added proper handling for if the logout URL contains a query string
  already.
- Added extra tests to cover.
- Forced config endpoint to be used, if set as a string, instead of
  autodiscovery endpoint.
This commit is contained in:
Dan Brown
2023-12-07 17:45:17 +00:00
parent a72e0fee70
commit 81d256aebd
3 changed files with 60 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
app/Access/Oidc/OidcService.php
View File

@ -84,7 +84,7 @@ class OidcService
'redirectUri' => url('/oidc/callback'),
'authorizationEndpoint' => $config['authorization_endpoint'],
'tokenEndpoint' => $config['token_endpoint'],
'endSessionEndpoint' => $config['end_session_endpoint'],
'endSessionEndpoint' => is_string($config['end_session_endpoint']) ? $config['end_session_endpoint'] : null,
]);
// Use keys if configured
@ -102,8 +102,11 @@ class OidcService
}
// Prevent use of RP-initiated logout if specifically disabled
// Or force use of a URL if specifically set.
if ($config['end_session_endpoint'] === false) {
$settings->endSessionEndpoint = null;
} else if (is_string($config['end_session_endpoint'])) {
$settings->endSessionEndpoint = $config['end_session_endpoint'];
}
$settings->validate();
@ -314,6 +317,8 @@ class OidcService
'post_logout_redirect_uri' => $defaultLogoutUrl,
];
return $oidcSettings->endSessionEndpoint . '?' . http_build_query($endpointParams);
$joiner = str_contains($oidcSettings->endSessionEndpoint, '?') ? '&' : '?';
return $oidcSettings->endSessionEndpoint . $joiner . http_build_query($endpointParams);
}
}