From 8d8f4a0ef0c7233f4135cb8956345aace6bab891 Mon Sep 17 00:00:00 2001 From: alep85 Date: Tue, 28 Oct 2025 15:32:55 +0100 Subject: [PATCH] AAE-37746 logout on session_error during session checks --- .../lib/auth/oidc/redirect-auth.service.spec.ts | 15 +++++++++++++++ .../src/lib/auth/oidc/redirect-auth.service.ts | 3 ++- 2 files changed, 17 insertions(+), 1 deletion(-) diff --git a/lib/core/src/lib/auth/oidc/redirect-auth.service.spec.ts b/lib/core/src/lib/auth/oidc/redirect-auth.service.spec.ts index bc16799499..537718bbf7 100644 --- a/lib/core/src/lib/auth/oidc/redirect-auth.service.spec.ts +++ b/lib/core/src/lib/auth/oidc/redirect-auth.service.spec.ts @@ -273,6 +273,21 @@ describe('RedirectAuthService', () => { expect(oauthServiceSpy.logOut).toHaveBeenCalledTimes(1); }); + it('should logout user if sessionChecksEnabled is true and event type session_error is emitted', async () => { + const mockTimeSync = { outOfSync: false } as TimeSync; + timeSyncServiceSpy.checkTimeSync.and.returnValue(of(mockTimeSync)); + + ensureDiscoveryDocumentSpy.and.resolveTo(true); + + authConfigSpy.sessionChecksEnabled = true; + + await service.init(); + + oauthEvents$.next({ type: 'session_error' } as OAuthEvent); + + expect(oauthServiceSpy.logOut).toHaveBeenCalledTimes(1); + }); + it('should NOT logout user if login success', async () => { ensureDiscoveryDocumentSpy.and.resolveTo(true); diff --git a/lib/core/src/lib/auth/oidc/redirect-auth.service.ts b/lib/core/src/lib/auth/oidc/redirect-auth.service.ts index 1f65ef0003..8aa97539d5 100644 --- a/lib/core/src/lib/auth/oidc/redirect-auth.service.ts +++ b/lib/core/src/lib/auth/oidc/redirect-auth.service.ts @@ -339,7 +339,8 @@ export class RedirectAuthService extends AuthService { this.oauthService.tokenValidationHandler = new JwksValidationHandler(); if (config.sessionChecksEnabled) { - this.oauthService.events.pipe(filter((event) => event.type === 'session_terminated')).subscribe(() => { + const sessionErrorTypesToPerformLogout = ['session_terminated', 'session_error']; + this.oauthService.events.pipe(filter((event) => sessionErrorTypesToPerformLogout.includes(event.type))).subscribe(() => { this.oauthService.logOut(); }); }