Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add POST Binding for RP-initiated OIDC Logout #13002

Open
yuezk opened this issue Apr 12, 2023 · 0 comments · May be fixed by #16214
Open

Add POST Binding for RP-initiated OIDC Logout #13002

yuezk opened this issue Apr 12, 2023 · 0 comments · May be fixed by #16214
Labels
in: oauth2 An issue in OAuth2 modules (oauth2-core, oauth2-client, oauth2-resource-server, oauth2-jose) type: enhancement A general enhancement

Comments

@yuezk
Copy link
Contributor

yuezk commented Apr 12, 2023 •
edited
Loading

Expected Behavior

According to the OIDC spec, the RP-initiated global logout request method could be POST or GET. But currently, the framework doesn't support the POST method.

OpenID Providers MUST support the use of the HTTP GET and POST methods defined in RFC 7231 [RFC7231] at the Logout Endpoint. RPs MAY use the HTTP GET or POST methods to send the logout request to the OP. If using the HTTP GET method, the request parameters are serialized using URI Query String Serialization. If using the HTTP POST method, the request parameters are serialized using Form Serialization.

Current Behavior

The OIDC global logout request seems only to support the GET request method in org.springframework.security.oauth2.client.oidc.web.logout.OidcClientInitiatedLogoutSuccessHandler.

Context

My question is: Is there any plan to support this, or is there any suggestions on implementing this at the production code? Thanks.
@yuezk yuezk added status: waiting-for-triage An issue we've not yet triaged type: enhancement A general enhancement labels Apr 12, 2023
@yuezk yuezk changed the title OIDC global logout doesn't support the POST request method RP-initiated OIDC global logout request doesn't support the POST request method Apr 12, 2023
@jzheaux jzheaux changed the title RP-initiated OIDC global logout request doesn't support the POST request method Add POST Binding for RP-initiated OIDC Logout Apr 17, 2023
@jzheaux jzheaux added in: oauth2 An issue in OAuth2 modules (oauth2-core, oauth2-client, oauth2-resource-server, oauth2-jose) and removed status: waiting-for-triage An issue we've not yet triaged labels Apr 17, 2023
@candrews candrews linked a pull request Dec 4, 2024 that will close this issue
Open
candrews added a commit to candrews/spring-security that referenced this issue Dec 4, 2024
@candrews
Add FormRedirectStrategy to enable POST OIDC Logout
cd8b993 
FormRedirectStrategy redirects using an autosubmitting HTML form using the POST method versus DefaultRedirectStrategy which redirects using the GET method.

Can be used to implement POST binding for relying party initiated OIDC logout by setting FormRedirectStrategy as the redirection strategy on OidcClientInitiatedLogoutSuccessHandler.

Closes spring-projectsgh-13002
candrews added a commit to candrews/spring-security that referenced this issue Dec 4, 2024
@candrews
Add FormRedirectStrategy to enable POST OIDC Logout
2c41332 
FormRedirectStrategy redirects using an autosubmitting HTML form using the POST method versus DefaultRedirectStrategy which redirects using the GET method.

Can be used to implement POST binding for relying party initiated OIDC logout by setting FormRedirectStrategy as the redirection strategy on OidcClientInitiatedLogoutSuccessHandler.

Closes spring-projectsgh-13002

Signed-off-by: Craig Andrews <[email protected]>
candrews added a commit to candrews/spring-security that referenced this issue Dec 4, 2024
@candrews
Add FormRedirectStrategy to enable POST OIDC Logout
34d6640 
FormRedirectStrategy redirects using an autosubmitting HTML form using the POST method versus DefaultRedirectStrategy which redirects using the GET method.

Can be used to implement POST binding for relying party initiated OIDC logout by setting FormRedirectStrategy as the redirection strategy on OidcClientInitiatedLogoutSuccessHandler.

Closes spring-projectsgh-13002

Signed-off-by: Craig Andrews <[email protected]>
candrews added a commit to candrews/spring-security that referenced this issue Dec 4, 2024
@candrews
Add FormRedirectStrategy to enable POST OIDC Logout
2b6f36f 
FormRedirectStrategy redirects using an autosubmitting HTML form using the POST method versus DefaultRedirectStrategy which redirects using the GET method.

Can be used to implement POST binding for relying party initiated OIDC logout by setting FormRedirectStrategy as the redirection strategy on OidcClientInitiatedLogoutSuccessHandler.

Closes spring-projectsgh-13002

Signed-off-by: Craig Andrews <[email protected]>
candrews added a commit to candrews/spring-security that referenced this issue Dec 4, 2024
@candrews
Add FormRedirectStrategy to enable POST OIDC Logout
95babac 
FormRedirectStrategy redirects using an autosubmitting HTML form using the POST method versus DefaultRedirectStrategy which redirects using the GET method.

Can be used to implement POST binding for relying party initiated OIDC logout by setting FormRedirectStrategy as the redirection strategy on OidcClientInitiatedLogoutSuccessHandler.

Closes spring-projectsgh-13002

Signed-off-by: Craig Andrews <[email protected]>
candrews added a commit to candrews/spring-security that referenced this issue Dec 4, 2024
@candrews
Add FormRedirectStrategy to enable POST OIDC Logout
ce06c2a 
FormRedirectStrategy redirects using an autosubmitting HTML form using the POST method versus DefaultRedirectStrategy which redirects using the GET method.

Can be used to implement POST binding for relying party initiated OIDC logout by setting FormRedirectStrategy as the redirection strategy on OidcClientInitiatedLogoutSuccessHandler.

Closes spring-projectsgh-13002

Signed-off-by: Craig Andrews <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
in: oauth2 An issue in OAuth2 modules (oauth2-core, oauth2-client, oauth2-resource-server, oauth2-jose) type: enhancement A general enhancement
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Add FormRedirectStrategy to enable POST OIDC Logout candrews/spring-security
2 participants
@yuezk @jzheaux