jazzband / django-oauth-toolkit

OAuth2 goodies for the Djangonauts!
https://django-oauth-toolkit.readthedocs.io
Other
3.16k stars 794 forks source link

Route "/o/logout" returns 500 Internal Server Error #1280

Closed Polaris-d closed 1 year ago

Polaris-d commented 1 year ago

Describe the bug When the logout request comes from an anonymous user and the ID Token is empty, clicking the Logout button will return 500 Internal Server Error

To Reproduce In the case of not logging in, open "/o/logout" directly, make sure that the parameter id_token_hint is not carried, and then click the "Logout" button to reproduce this problem

Expected behavior I think that when no id_token is provided and it is impossible to confirm which user the request came from, a 400 error should be returned to remind the user that we cannot perform an exit operation for him/her

Version V2.3.0