diff --git a/lib/core/src/lib/auth/oidc/redirect-auth.service.spec.ts b/lib/core/src/lib/auth/oidc/redirect-auth.service.spec.ts index bc16799499..537718bbf7 100644 --- a/lib/core/src/lib/auth/oidc/redirect-auth.service.spec.ts +++ b/lib/core/src/lib/auth/oidc/redirect-auth.service.spec.ts @@ -273,6 +273,21 @@ describe('RedirectAuthService', () => { expect(oauthServiceSpy.logOut).toHaveBeenCalledTimes(1); }); + it('should logout user if sessionChecksEnabled is true and event type session_error is emitted', async () => { + const mockTimeSync = { outOfSync: false } as TimeSync; + timeSyncServiceSpy.checkTimeSync.and.returnValue(of(mockTimeSync)); + + ensureDiscoveryDocumentSpy.and.resolveTo(true); + + authConfigSpy.sessionChecksEnabled = true; + + await service.init(); + + oauthEvents$.next({ type: 'session_error' } as OAuthEvent); + + expect(oauthServiceSpy.logOut).toHaveBeenCalledTimes(1); + }); + it('should NOT logout user if login success', async () => { ensureDiscoveryDocumentSpy.and.resolveTo(true); diff --git a/lib/core/src/lib/auth/oidc/redirect-auth.service.ts b/lib/core/src/lib/auth/oidc/redirect-auth.service.ts index 1f65ef0003..8aa97539d5 100644 --- a/lib/core/src/lib/auth/oidc/redirect-auth.service.ts +++ b/lib/core/src/lib/auth/oidc/redirect-auth.service.ts @@ -339,7 +339,8 @@ export class RedirectAuthService extends AuthService { this.oauthService.tokenValidationHandler = new JwksValidationHandler(); if (config.sessionChecksEnabled) { - this.oauthService.events.pipe(filter((event) => event.type === 'session_terminated')).subscribe(() => { + const sessionErrorTypesToPerformLogout = ['session_terminated', 'session_error']; + this.oauthService.events.pipe(filter((event) => sessionErrorTypesToPerformLogout.includes(event.type))).subscribe(() => { this.oauthService.logOut(); }); }