spring-projects / spring-projects/spring-security
OidcClientInitiatedLogoutSuccessHandler generates incorrection logout URL when behind gateway/proxy
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 9.6k
- Forks
- 6.3k
- Avg merge
- 2d 11h
- Merged PRs (30d)
- 52
Description
Expected Behavior
I have set up a spring cloud gateway that acts as an oauth2 client for token handling (back-end for front-end kind of approach)
When spring authorization server is proxied via spring cloud gateway, the logout URL generated by OidcClientInitiatedLogoutSuccessHandler generates a logout URL that is based on the "internal" hostname and port as configured on the registered client.
This is an example of my gateway config:
server:
port: 80
spring:
cloud:
gateway:
server:
webflux:
discovery:
locator:
enabled: true
routes:
- id: resource-server
uri: http://localhost:8090
predicates:
Path=/resource/**
filters:
- TokenRelay
- RemoveRequestHeader=Cookie
- id: auth-server
uri: http://localhost:8080
predicates:
Path=/auth/**
filters:
- PreserveHostHeader
security:
oauth2:
resourceserver:
jwt:
issuer-uri: http://localhost:8080/auth
jwk-set-uri: http://localhost:8080/auth/oauth2/jwks
client:
registration:
sample-oidc:
provider: gateway-client-provider
client-id: sample-client
client-secret: sample-client
authorization-grant-type: authorization_code
redirect-uri: "{baseUrl}/login/oauth2/code/{registrationId}"
scope:
- openid
- profile
client-name: sample-oidc
provider:
gateway-client-provider:
issuer-uri: http://localhost:8080/auth
authorization-uri: http://localhost/auth/oauth2/authorize
token-uri: http://localhost:8080/auth/oauth2/token
jwk-set-uri: http://localhost:8080/auth/oauth2/jwks
user-info-uri: http://localhost:8080/auth/userinfo
user-name-attribute: sub
My security filter chain in the gateway looks like this:
@Bean
public SecurityWebFilterChain browserFilterChain(ServerHttpSecurity http, ReactiveClientRegistrationRepository reactiveClientRegistrationRepository) {
http
.authorizeExchange(authorize -> authorize
.pathMatchers("/auth/**").permitAll()
.anyExchange().authenticated()
)
.oauth2Login(Customizer.withDefaults())
.logout(logout -> logout.logoutSuccessHandler(new OidcClientInitiatedServerLogoutSuccessHandler(reactiveClientRegistrationRepository)))
.cors(ServerHttpSecurity.CorsSpec::disable)
.csrf(ServerHttpSecurity.CsrfSpec::disable);
return http.build();
}
When I call localhost/logout, spring security will now redirect to http://localhost:8080/auth/connect/logout?id_token_hint=eyJraWQ.... I would expect that it redirects to http://localhost/auth/connect/logout?id_token_hint=eyJraWQ...
So far, I did not find any workaround yet apart from creating a rough copy of OidcClientInitiatedServerLogoutSuccessHandler and changing the logic for determining the logout URL.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with OidcClientInitiatedServerLogoutSuccessHandler and the gateway configuration shown in the issue, focusing on how the logout URL host and port are determined behind the proxy. Reproduce the redirect from /logout and compare it with the expected gateway URL; done means the generated URL uses the external gateway host while retaining the id_token_hint.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java, spring
- Domain
- authentication, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100