Skip to content

Add POST Binding for RP-initiated OIDC Logout #13002

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Closed
yuezk opened this issue Apr 12, 2023 · 0 comments · Fixed by #16214
Closed

Add POST Binding for RP-initiated OIDC Logout #13002

yuezk opened this issue Apr 12, 2023 · 0 comments · Fixed by #16214
Assignees
@sjohnr
Labels
in: oauth2 An issue in OAuth2 modules (oauth2-core, oauth2-client, oauth2-resource-server, oauth2-jose) status: duplicate A duplicate of another issue type: enhancement A general enhancement
Milestone
6.5.0-M2

Comments

@yuezk
Copy link
Contributor

yuezk commented Apr 12, 2023 •
edited
Loading

Expected Behavior

According to the OIDC spec, the RP-initiated global logout request method could be POST or GET. But currently, the framework doesn't support the POST method.

OpenID Providers MUST support the use of the HTTP GET and POST methods defined in RFC 7231 [RFC7231] at the Logout Endpoint. RPs MAY use the HTTP GET or POST methods to send the logout request to the OP. If using the HTTP GET method, the request parameters are serialized using URI Query String Serialization. If using the HTTP POST method, the request parameters are serialized using Form Serialization.

Current Behavior

The OIDC global logout request seems only to support the GET request method in org.springframework.security.oauth2.client.oidc.web.logout.OidcClientInitiatedLogoutSuccessHandler.

Context

My question is: Is there any plan to support this, or is there any suggestions on implementing this at the production code? Thanks.
@yuezk yuezk added status: waiting-for-triage An issue we've not yet triaged type: enhancement A general enhancement labels Apr 12, 2023
@yuezk yuezk changed the title OIDC global logout doesn't support the POST request method RP-initiated OIDC global logout request doesn't support the POST request method Apr 12, 2023
@jzheaux jzheaux changed the title RP-initiated OIDC global logout request doesn't support the POST request method Add POST Binding for RP-initiated OIDC Logout Apr 17, 2023
@jzheaux jzheaux added in: oauth2 An issue in OAuth2 modules (oauth2-core, oauth2-client, oauth2-resource-server, oauth2-jose) and removed status: waiting-for-triage An issue we've not yet triaged labels Apr 17, 2023
@candrews candrews mentioned this issue Dec 4, 2024
Merged
candrews added a commit to candrews/spring-security that referenced this issue Dec 4, 2024
@candrews
Add FormRedirectStrategy to enable POST OIDC Logout
cd8b993 
FormRedirectStrategy redirects using an autosubmitting HTML form using the POST method versus DefaultRedirectStrategy which redirects using the GET method.

Can be used to implement POST binding for relying party initiated OIDC logout by setting FormRedirectStrategy as the redirection strategy on OidcClientInitiatedLogoutSuccessHandler.

Closes spring-projectsgh-13002
candrews added a commit to candrews/spring-security that referenced this issue Dec 4, 2024
@candrews
Add FormRedirectStrategy to enable POST OIDC Logout
2c41332 
FormRedirectStrategy redirects using an autosubmitting HTML form using the POST method versus DefaultRedirectStrategy which redirects using the GET method.

Can be used to implement POST binding for relying party initiated OIDC logout by setting FormRedirectStrategy as the redirection strategy on OidcClientInitiatedLogoutSuccessHandler.

Closes spring-projectsgh-13002

Signed-off-by: Craig Andrews <[email protected]>
candrews added a commit to candrews/spring-security that referenced this issue Dec 4, 2024
@candrews
Add FormRedirectStrategy to enable POST OIDC Logout
34d6640 
FormRedirectStrategy redirects using an autosubmitting HTML form using the POST method versus DefaultRedirectStrategy which redirects using the GET method.

Can be used to implement POST binding for relying party initiated OIDC logout by setting FormRedirectStrategy as the redirection strategy on OidcClientInitiatedLogoutSuccessHandler.

Closes spring-projectsgh-13002

Signed-off-by: Craig Andrews <[email protected]>
candrews added a commit to candrews/spring-security that referenced this issue Dec 4, 2024
@candrews
Add FormRedirectStrategy to enable POST OIDC Logout
2b6f36f 
FormRedirectStrategy redirects using an autosubmitting HTML form using the POST method versus DefaultRedirectStrategy which redirects using the GET method.

Can be used to implement POST binding for relying party initiated OIDC logout by setting FormRedirectStrategy as the redirection strategy on OidcClientInitiatedLogoutSuccessHandler.

Closes spring-projectsgh-13002

Signed-off-by: Craig Andrews <[email protected]>
candrews added a commit to candrews/spring-security that referenced this issue Dec 4, 2024
@candrews
Add FormRedirectStrategy to enable POST OIDC Logout
95babac 
FormRedirectStrategy redirects using an autosubmitting HTML form using the POST method versus DefaultRedirectStrategy which redirects using the GET method.

Can be used to implement POST binding for relying party initiated OIDC logout by setting FormRedirectStrategy as the redirection strategy on OidcClientInitiatedLogoutSuccessHandler.

Closes spring-projectsgh-13002

Signed-off-by: Craig Andrews <[email protected]>
candrews added a commit to candrews/spring-security that referenced this issue Dec 4, 2024
@candrews
Add FormRedirectStrategy to enable POST OIDC Logout
ce06c2a 
FormRedirectStrategy redirects using an autosubmitting HTML form using the POST method versus DefaultRedirectStrategy which redirects using the GET method.

Can be used to implement POST binding for relying party initiated OIDC logout by setting FormRedirectStrategy as the redirection strategy on OidcClientInitiatedLogoutSuccessHandler.

Closes spring-projectsgh-13002

Signed-off-by: Craig Andrews <[email protected]>
sjohnr pushed a commit to candrews/spring-security that referenced this issue Jan 29, 2025
@candrews @sjohnr
Add FormRedirectStrategy to enable POST OIDC Logout
23ea2bf 
FormRedirectStrategy redirects using an autosubmitting HTML form using the POST method versus DefaultRedirectStrategy which redirects using the GET method.

Can be used to implement POST binding for relying party initiated OIDC logout by setting FormRedirectStrategy as the redirection strategy on OidcClientInitiatedLogoutSuccessHandler.

Closes spring-projectsgh-13002

Signed-off-by: Craig Andrews <[email protected]>
sjohnr pushed a commit to candrews/spring-security that referenced this issue Feb 3, 2025
@candrews @sjohnr
Add FormRedirectStrategy to enable POST OIDC Logout
aff4995 
FormRedirectStrategy redirects using an autosubmitting HTML form using the POST method versus DefaultRedirectStrategy which redirects using the GET method.

Can be used to implement POST binding for relying party initiated OIDC logout by setting FormRedirectStrategy as the redirection strategy on OidcClientInitiatedLogoutSuccessHandler.

Closes spring-projectsgh-13002

Signed-off-by: Craig Andrews <[email protected]>
sjohnr pushed a commit that referenced this issue Feb 3, 2025
@candrews @sjohnr
Add FormRedirectStrategy to enable POST OIDC Logout
58534e7 
FormRedirectStrategy redirects using an autosubmitting HTML form using the POST method versus DefaultRedirectStrategy which redirects using the GET method.

Can be used to implement POST binding for relying party initiated OIDC logout by setting FormRedirectStrategy as the redirection strategy on OidcClientInitiatedLogoutSuccessHandler.

Closes gh-13002

Signed-off-by: Craig Andrews <[email protected]>
@sjohnr sjohnr added the status: duplicate A duplicate of another issue label Feb 3, 2025
@sjohnr sjohnr added this to the 6.5.0-M2 milestone Feb 3, 2025
@sjohnr sjohnr self-assigned this Feb 3, 2025
@sjohnr sjohnr mentioned this issue Feb 5, 2025
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@sjohnr sjohnr

Labels
in: oauth2 An issue in OAuth2 modules (oauth2-core, oauth2-client, oauth2-resource-server, oauth2-jose) status: duplicate A duplicate of another issue type: enhancement A general enhancement
Projects
None yet
Milestone
6.5.0-M2
Development

Successfully merging a pull request may close this issue.

Add FormPostRedirectStrategy to enable POST OIDC Logout candrews/spring-security
3 participants
@yuezk @jzheaux @sjohnr