-
Notifications
You must be signed in to change notification settings - Fork 2.9k
Description
Description
https://openid.net/specs/openid-connect-rpinitiated-1_0.html#RFC7231 supports 2 redirects modes.
By default, the logout properties are submitted as HTTP query parameters with the GET request.
But the spec also allows the use of the form based POST submission - which Quarkus OIDC can also support
Implementation ideas
It should be implemented similarly to how OIDC providers themselves deal with the form_post response mode:
By default the response_mode
is query
, meaning all the authorization code flow response parameters are returned to the RP (Quarkus) as query parameters. But if the response_mode=form_post
then the OIDC provider returns an HTML page to the user which auto-submits a form payload to the RP (Quarkus).
Similarly with the RP initiated logout. By default, the logout properties are serialized as query parameters, let's have it activated by default (as is the case now), by analogy with the existing quarkus.oidc.authentication.response-mode=query
, with quarkus.oidc.logout.redirect-mode=query
.
If the user says quarkus.oidc.logout.redirect-mode=form-post
, then Quarkus OIDC returns HTTP 200 with the HTML page which auto-submits to the provider's logout endpoint.
CC @calvernaz
Metadata
Metadata
Assignees
Labels
Type
Projects
Status