Skip to content

Support for the form post redirect mode with RP Initiated logout #48435

@sberyozkin

Description

@sberyozkin

Description

https://openid.net/specs/openid-connect-rpinitiated-1_0.html#RFC7231 supports 2 redirects modes.
By default, the logout properties are submitted as HTTP query parameters with the GET request.
But the spec also allows the use of the form based POST submission - which Quarkus OIDC can also support

Implementation ideas

It should be implemented similarly to how OIDC providers themselves deal with the form_post response mode:

By default the response_mode is query, meaning all the authorization code flow response parameters are returned to the RP (Quarkus) as query parameters. But if the response_mode=form_post then the OIDC provider returns an HTML page to the user which auto-submits a form payload to the RP (Quarkus).

Similarly with the RP initiated logout. By default, the logout properties are serialized as query parameters, let's have it activated by default (as is the case now), by analogy with the existing quarkus.oidc.authentication.response-mode=query, with quarkus.oidc.logout.redirect-mode=query.

If the user says quarkus.oidc.logout.redirect-mode=form-post, then Quarkus OIDC returns HTTP 200 with the HTML page which auto-submits to the provider's logout endpoint.

CC @calvernaz

Metadata

Metadata

Assignees

Type

No type

Projects

Status

Done

Milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions