dotnet / dotnet/aspnetcore

AutoRedirectEndSessionEndpoint doesn't redirect to the configured PostLogoutUri

Open
#22,170 4 comments 0 reactions 0 assignees View on GitHub
affected-few area-identity enhancement severity-minor
Dominant language
C#
Stars
38.4k
Forks
10.9k
Avg merge
2d 10h
Merged PRs (30d)
281

Description

### Describe the bug
When a client configuration doesn't not contains a Profile property the [AutoRedirectEndSessionEndpoint](https://github.com/dotnet/aspnetcore/blob/35628a67800a3e269eb375989d2fffa9d67b8dbf/src/Identity/ApiAuthorization.IdentityServer/src/Extensions/AutoRedirectEndSessionEndpoint.cs#L60) doesn't redirect to the configured post logout uri but to UserInteraction.LogoutUrl.

IMO it's a bug, the profile type is not required nor used in this code. But `result.ValidatedRequest.PostLogOutUri` should be validated.

### To Reproduce
- Add client to the IdentityServer configuration with a PostLogoutUri and without Profile property.
- Login/Logout
The client loged out screen is not displayed.
``` C#
new Client
{
ClientClaimsPrefix = null,
ClientId = "theidserver-swagger",
ClientName = "TheIdServer Swagger UI",
AllowedGrantTypes = GrantTypes.Implicit,
RequireClientSecret = false,
BackChannelLogoutSessionRequired = false,
FrontChannelLogoutSessionRequired = false,
RedirectUris =
{
"https://localhost:5443/login.html",
},
PostLogoutRedirectUris =
{
"https://localhost:5443/logedout.html",
},
AllowedCorsOrigins =
{
"https://localhost:5443",
},
AllowedScopes = { "theidserveradminapi" },
AllowAccessTokensViaBrowser = true
}
```

### Further technical details
- ASP.NET Core version 3.1.4

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.