AutoRedirectEndSessionEndpoint doesn't redirect to the configured PostLogoutUri
- Dominant language
- C#
- Stars
- 38.4k
- Forks
- 10.9k
- Avg merge
- 2d 10h
- Merged PRs (30d)
- 281
Description
### Describe the bug
When a client configuration doesn't not contains a Profile property the [AutoRedirectEndSessionEndpoint](https://github.com/dotnet/aspnetcore/blob/35628a67800a3e269eb375989d2fffa9d67b8dbf/src/Identity/ApiAuthorization.IdentityServer/src/Extensions/AutoRedirectEndSessionEndpoint.cs#L60) doesn't redirect to the configured post logout uri but to UserInteraction.LogoutUrl.
IMO it's a bug, the profile type is not required nor used in this code. But `result.ValidatedRequest.PostLogOutUri` should be validated.
### To Reproduce
- Add client to the IdentityServer configuration with a PostLogoutUri and without Profile property.
- Login/Logout
The client loged out screen is not displayed.
``` C#
new Client
{
ClientClaimsPrefix = null,
ClientId = "theidserver-swagger",
ClientName = "TheIdServer Swagger UI",
AllowedGrantTypes = GrantTypes.Implicit,
RequireClientSecret = false,
BackChannelLogoutSessionRequired = false,
FrontChannelLogoutSessionRequired = false,
RedirectUris =
{
"https://localhost:5443/login.html",
},
PostLogoutRedirectUris =
{
"https://localhost:5443/logedout.html",
},
AllowedCorsOrigins =
{
"https://localhost:5443",
},
AllowedScopes = { "theidserveradminapi" },
AllowAccessTokensViaBrowser = true
}
```
### Further technical details
- ASP.NET Core version 3.1.4
Contributor guide
Assessment
This issue has not been assessed yet.