inteligr8/alfresco-ng2-components
1
0
Fork 0
mirror of https://github.com/Alfresco/alfresco-ng2-components.git synced 2026-09-09 18:03:21 +00:00
Code Issues Packages Projects Releases Wiki Activity

AAE-37746 revert previous changes, update the front-channel-logout component logic to always logout the user

Browse Source
This commit is contained in:
alep85
2025-10-28 15:33:42 +01:00
parent a392fc22f1
commit 4e349fb905
6 changed files with 13 additions and 280 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/core/components/front-channel-logout.component.md
+9 -43
View File
@@ -7,7 +7,7 @@ Last reviewed: 2025-10-24
# [Front Channel Logout component](../../../lib/core/src/lib/auth/oidc/front-channel-logout.component.ts "Defined in front-channel-logout.component.ts")
Handles an OpenID Connect (OIDC) Front-Channel Logout request by validating issuer and session identifiers and triggering a local logout when they match.
Handles an OpenID Connect (OIDC) Front-Channel Logout request by always triggering a local logout when the route is hit.
## Contents
@@ -32,13 +32,9 @@ export const routes: Routes = [
];
```
When the IdP performs a front-channel logout it will iframe / redirect the user's browser to a URL like:
When the IdP performs a front-channel logout it will iframe or redirect the user's browser to the configured route (e.g. `/oidc/frontchannel_logout`).
```text
/oidc/frontchannel_logout?iss=https://issuer.example.com&sid=abc123-session-id
```
On initialisation the component compares those query parameters with locally stored values provided by `AuthService` and calls `logout()` if both match.
On initialisation the component always calls `logout()` via `AuthService`, regardless of any query parameters.
## Details
@@ -46,48 +42,18 @@ On initialisation the component compares those query parameters with locally sto
Front-Channel Logout is part of the OIDC specification. The Identity Provider notifies relying parties (your SPA) of a logout by issuing an HTTP(S) request (often via an iframe). The client application must validate the request and clear its own session.
### How matching works
### How it works
Inside `ngOnInit` the component:
1. Reads `iss` and `sid` from `ActivatedRoute.snapshot.queryParamMap`.
2. Retrieves the stored issuer and session id via `AuthService.getStoredIssuer()` and `AuthService.getStoredSessionId()`.
3. Compares both pairs. Logout is executed only if:
- storedIssuer === issuerParam AND
- storedSessionId === sessionIdParam (and none are falsy).
```ts
const storedIssuerMatches = storedIssuer && issuerParam && storedIssuer === issuerParam;
const storedSessionMatches = storedSessionId && sessionIdParam && storedSessionId === sessionIdParam;
if (storedIssuerMatches && storedSessionMatches) {
authService.logout();
}
```
If either value is missing or does not match, nothing happens.
On `ngOnInit`, the component simply calls `authService.logout()`. There is no check for issuer or session ID; logout is unconditional.
### Security considerations
- The component performs strict equality checks; no partial matching.
- Both parameters must be present and match; a single match will not trigger logout.
- Avoid exposing sensitive data in query parameters beyond issuer (`iss`) and session identifier (`sid`).
- The component does not inspect or require any query parameters.
- No sensitive data is read from the URL.
### Logout scenarios
### Logout behavior
These scenarios outline when a logout is triggered or suppressed.
Key scenarios:
| Scenario | Stored Issuer | URL Issuer | Stored SID | URL SID | Outcome |
|----------|---------------|-----------|------------|---------|---------|
| Full match | A | A | 123 | 123 | logout called |
| Issuer mismatch | A | B | 123 | 123 | no logout |
| SID mismatch | A | A | 123 | 999 | no logout |
| Both mismatch | A | B | 123 | 999 | no logout |
| Missing issuer | null | A | 123 | 123 | no logout |
| Missing SID | A | A | null | 123 | no logout |
| Missing URL issuer | A | null | 123 | 123 | no logout |
| Missing URL SID | A | A | 123 | null | no logout |
Whenever this route is hit, the user is always logged out, regardless of any parameters or state.
### See also