openid / openid/AppAuth-iOS

iOS EndSessionRequest without idTokenHint

Open
#665 2 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Objective-C
Stars
2k
Forks
867
Avg merge
4d 48m
Merged PRs (30d)
1

Description

Describe the bug

OIDEndSessionRequest on iOS can not be instantiated without idTokenHint.
When using an empty String as idTokenHint, the Keykloak Server shows "Session not Active" an does not destroy the session.

OIDEndSessionRequest property idTokenHint is marked es 'nullable' but not in the init-Method:

iOS API OIDEndSessionRequest:

`@property(nonatomic, readonly, nullable) NSString *idTokenHint;

  • (instancetype)
    initWithConfiguration:(OIDServiceConfiguration *)configuration
    idTokenHint:(NSString *)idTokenHint
    postLogoutRedirectURL:(NSURL *)postLogoutRedirectURL
    additionalParameters:(nullable NSDictionary<NSString *, NSString *> *)additionalParameters;`

On Android, its possible to create an EndSession-Request without idToken and logout successfully on our Keykloak Server.

To Reproduce
Create EndSessionRequest in Swift
Swift API reqires to specifiy an idTokenHint
Using "" as idTokenHint
Keykloak shows "Session not Active"

Expected behavior
The OIDEndSessionRequest Initializer can be called without idTokenHint.

Screenshots
Code_EndSessionRequest

keykloak_sessionnotactive

Smartphone (please complete the following information):

  • Device: iOS Device
  • OS: iOS15
  • Browser SafariViewController
  • AppAuth Version 1.4

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the OIDEndSessionRequest initializer declaration and its nullable idTokenHint property. Compare how the iOS request is constructed when the hint is absent with the reported empty-string case, then verify that an initializer without idTokenHint can be used for logout as expected.

Written by the indexing model from the issue text.

Assessment

Tech stack
ios, objective-c
Domain
authentication, mobile-dev
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
38/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.