Optionally logout from login.gov

[s2t2]

Right now, the logout link signs the user out of this application, but does not also sign them out of login.gov. There are situations where this is desirable, however there are also situations where it would be desirable to also sign the user out of login.gov. For demonstration purposes, this application should present the user with an option to do either.

See: https://developers.login.gov/openid-connect/#logout-request for information about making the logout request:

https://idp.int.login.gov/openid_connect/logout?
  id_token_hint=eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9.eyJzdWIiOiJiMmQyZDExNS0xZDdlLTQ1NzktYjlkNi1mOGU4NGY0ZjU2Y2EiLCJpc3MiOiJodHRwczovL2lkcC5pbnQubG9naW4uZ292IiwiYWNyIjoiaHR0cDovL2lkbWFuYWdlbWVudC5nb3YvbnMvYXNzdXJhbmNlL2xvYS8xIiwibm9uY2UiOiJhYWQwYWE5NjljMTU2YjJkZmE2ODVmODg1ZmFjNzA4MyIsImF1ZCI6InVybjpnb3Y6Z3NhOm9wZW5pZGNvbm5lY3Q6ZGV2ZWxvcG1lbnQiLCJqdGkiOiJqQzdOblU4ZE5OVjVsaXNRQm0xanRBIiwiYXRfaGFzaCI6InRsTmJpcXIxTHIyWWNOUkdqendsSWciLCJjX2hhc2giOiJoWGpxN2tPcnRRS196YV82dE9OeGN3IiwiZXhwIjoxNDg5Njk0MTk2LCJpYXQiOjE0ODk2OTQxOTgsIm5iZiI6MTQ4OTY5NDE5OH0.pVbPF-2LJSG1fE9thn27PwmDlNdlc3mEm7fFxb8ZADdRvYmDMnDPuZ3TGHl0ttK78H8NH7rBpH85LZzRNtCcWjS7QcycXHMn00Cuq_Bpbn7NRdf3ktxkBrpqyzIArLezVJJVXn2EeykXMvzlO-fJ7CaDUaJMqkDhKOK6caRYePBLbZJFl0Ri25bqXugguAYTyX9HACaxMNFtQOwmUCVVr6WYL1AMV5WmaswZtdE8POxYdhzwj777rkgSg555GoBDZy3MetapbT0csSWqVJ13skWTXBRrOiQQ70wzHAu_3ktBDXNoLx4kG1fr1BiMEbHjKsHs14X8LCBcIMdt49hIZg&
  post_logout_redirect_uri=${REDIRECT_URI}&
  state=abcdefghijklmnopabcdefghijklmnop

[s2t2]

Reference: Example logout code from the node.js openid client.

Although similar code produces an express redirect error that never resolves:

// Logout from this application and from login.gov
    app.get('/auth/login-gov/oidc-logout', function(req, res, next) {
        //req.logout();

        const logoutUrl = `${loginGov.discoveryUrl}/openid_connect/logout`
        console.log("LOGOUT URL", logoutUrl)

        res.redirect(logoutUrl, {
          search: null,
          query: {
            id_token_hint: "ABC-123",
            state: loginGov.randomString(32),
            post_logout_redirect_uri: logoutRedirectUrl
          }
        });
    });

EDIT: a redirect happens without error if the query params are hard-coded into the url string:

res.redirect(requestUrl);

Right now the server doesn't recognize the post-logout redirect url because it doesn't recognize the service provider because it detects the service provider by parsing the token. So next steps should be to pass the proper token, and both of these server errors should go away.

[s2t2]

Logout Reference:

• https://github.com/18F/fs-permit-platform/blob/6f3681a5861d96db76c279f726c23971f3e037c7/server/src/auth/passport-config.es6#L41-L56