auth-module fix: logout-redirect oauth2

fix: logout-redirect oauth2

Open mht-dotsource opened this issue 4 years ago • 4 comments

At the moment the redirect for logout in oauth2 is configured to use the parameter logout_uri.

According to my knowledge this value is not used by any oauth2 provider.

An industry standard, e.g. keycloak https://www.keycloak.org/docs/latest/securing_apps/#logout uses redirect_uri in the same way redirects are communicated in Authorization Request and Access Token Request are defined https://www.rfc-editor.org/info/rfc6749

This behaviour looks smart because it is compatible with the openId connect session draft. This specification accepts equal redirect_uri or post_logout_redirect_uri. See https://openid.net/specs/openid-connect-session-1_0.html