logout

listify-api/src/auth/oidc.service.ts

@@ -180,6 +180,7 @@ export class OidcService {
   async createLogoutUrl(idTokenHint?: string): Promise<string> {
     const config = this.getConfig();
     const discovery = await this.getDiscovery(config);
+    const state = this.createOpaqueToken();
     const logoutUrl = new URL(
       discovery.end_session_endpoint ??
         `${config.issuer.replace(/\/$/, '')}/oidc/session/end`,
@@ -196,6 +197,8 @@ export class OidcService {
       );
     }
 
+    logoutUrl.searchParams.set('state', state);
+
     return logoutUrl.toString();
   }
 
@@ -337,6 +340,10 @@ export class OidcService {
       );
     }
 
+    const postLogoutRedirectUri =
+      process.env.OIDC_POST_LOGOUT_REDIRECT_URI?.trim() ||
+      new URL('/auth/sso/logout-callback', redirectUri).toString();
+
     return {
       issuer,
       discoveryUrl: `${issuer}/.well-known/openid-configuration`,
@@ -344,7 +351,7 @@ export class OidcService {
       redirectUri,
       clientSecret: process.env.OIDC_CLIENT_SECRET,
       scopes: process.env.OIDC_SCOPES ?? 'openid profile email groups',
-      postLogoutRedirectUri: process.env.OIDC_POST_LOGOUT_REDIRECT_URI,
+      postLogoutRedirectUri,
       accessTokenAudience: process.env.OIDC_ACCESS_TOKEN_AUDIENCE ?? clientId,
       groupsClaim: process.env.OIDC_GROUPS_CLAIM ?? 'groups',
     };