grist-core icon indicating copy to clipboard operation
grist-core copied to clipboard

[OIDC] `post_logout_redirect_uri` is wrong when `ORG_IN_PATH=true`

Open vviers opened this issue 4 months ago • 8 comments

Describe the current behavior

The URL after loging out of Grist is https://{URL}/o/{ORG}/signed-out when it should be something like https://{URL}/signed-out

Indeed, the OIDC spec states that post_logout_redirect_uri "MUST have been previously registered with the OP, either using the post_logout_redirect_uris Registration parameter or via another mechanism."

However, it is impossible to register all possible, orgs-specific, logout urls. You can't register a wildcarded URL either such as https://{URL}/o/*/signed-out

Steps to reproduce

  1. Create a Grist instance with ORG_IN_PATH set to true
  2. Log in
  3. Navigate to a team site
  4. Log out

Describe the expected behavior

Logout URL should not depend on which team site you sign out from.

https://{URL}/signed-out seems sensible as a value.

Where have you encountered this bug?

Instance information (when self-hosting only)

  • Grist instance:
    • Version: 1.1.18
    • Installation mode: k8s
    • Architecture: multi-workers

vviers avatar Oct 01 '24 15:10 vviers