spring-projects / spring-projects/spring-security

OidcClientInitiatedLogoutSuccessHandler generates incorrection logout URL when behind gateway/proxy

Open
#19,155 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

status: waiting-for-triage type: enhancement
Dominant language
Java
Stars
9.6k
Forks
6.3k
Avg merge
2d 11h
Merged PRs (30d)
52

Description

Expected Behavior

I have set up a spring cloud gateway that acts as an oauth2 client for token handling (back-end for front-end kind of approach)
When spring authorization server is proxied via spring cloud gateway, the logout URL generated by OidcClientInitiatedLogoutSuccessHandler generates a logout URL that is based on the "internal" hostname and port as configured on the registered client.

This is an example of my gateway config:

server:
  port: 80
spring:
  cloud:
    gateway:
      server:
        webflux:
          discovery:
            locator:
              enabled: true
          routes:
            - id: resource-server
              uri: http://localhost:8090
              predicates:
                Path=/resource/**
              filters:
                - TokenRelay
                - RemoveRequestHeader=Cookie
            - id: auth-server
              uri: http://localhost:8080
              predicates:
                  Path=/auth/**
              filters:
                - PreserveHostHeader
  security:
    oauth2:
      resourceserver:
        jwt:
          issuer-uri: http://localhost:8080/auth
          jwk-set-uri: http://localhost:8080/auth/oauth2/jwks 
      client:
        registration:
          sample-oidc:
            provider: gateway-client-provider
            client-id: sample-client
            client-secret: sample-client
            authorization-grant-type: authorization_code
            redirect-uri: "{baseUrl}/login/oauth2/code/{registrationId}"
            scope:
              - openid
              - profile
            client-name: sample-oidc
        provider:
          gateway-client-provider:
            issuer-uri: http://localhost:8080/auth
            authorization-uri: http://localhost/auth/oauth2/authorize
            token-uri: http://localhost:8080/auth/oauth2/token
            jwk-set-uri: http://localhost:8080/auth/oauth2/jwks
            user-info-uri: http://localhost:8080/auth/userinfo
            user-name-attribute: sub

My security filter chain in the gateway looks like this:

@Bean
public SecurityWebFilterChain browserFilterChain(ServerHttpSecurity http, ReactiveClientRegistrationRepository reactiveClientRegistrationRepository) {
        http
                .authorizeExchange(authorize -> authorize
                        .pathMatchers("/auth/**").permitAll()
                        .anyExchange().authenticated()
                )
                .oauth2Login(Customizer.withDefaults())
                .logout(logout -> logout.logoutSuccessHandler(new OidcClientInitiatedServerLogoutSuccessHandler(reactiveClientRegistrationRepository)))
                .cors(ServerHttpSecurity.CorsSpec::disable)
                .csrf(ServerHttpSecurity.CsrfSpec::disable);
        return http.build();
    }

When I call localhost/logout, spring security will now redirect to http://localhost:8080/auth/connect/logout?id_token_hint=eyJraWQ.... I would expect that it redirects to http://localhost/auth/connect/logout?id_token_hint=eyJraWQ...

So far, I did not find any workaround yet apart from creating a rough copy of OidcClientInitiatedServerLogoutSuccessHandler and changing the logic for determining the logout URL.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with OidcClientInitiatedServerLogoutSuccessHandler and the gateway configuration shown in the issue, focusing on how the logout URL host and port are determined behind the proxy. Reproduce the redirect from /logout and compare it with the expected gateway URL; done means the generated URL uses the external gateway host while retaining the id_token_hint.

Written by the indexing model from the issue text.

Assessment

Tech stack
java, spring
Domain
authentication, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.