auth0 / express-openid-connect

An Express.js middleware to protect OpenID Connect web applications.
MIT License
460 stars 139 forks source link

Remove hard-coded logout endpoint for broader provider compatibility #621

Closed chesspro13 closed 3 months ago

chesspro13 commented 3 months ago

Checklist

Describe the problem you'd like to have solved

When using express-openid-connect to authenticate users with Authentik, the logout URI endpoint is hardcoded to be /v2/logout where Authentik's logout endpoint is /end-session/.

Describe the ideal solution

Remove hard-coded logout endpoints and add it as a config parameter.

Alternatives and current workarounds

No response

Additional context

No response

frederikprijck commented 3 months ago

Can you elaborate on what the problem is? We only hardcode that URL in the case when Auth0 is used, which is done here.

If it's not auth0, we expect the logout url to be defined in the end_session_endpoint, as per the OIDC specification.

chesspro13 commented 3 months ago

I overlooked that. Thank you for your time.