manfredsteyer / angular-oauth2-oidc

Support for OAuth 2 and OpenId Connect (OIDC) in Angular.
MIT License
1.86k stars 681 forks source link

Requests are canceled on logout #1400

Open igortelheiro opened 3 months ago

igortelheiro commented 3 months ago

Describe the bug I have been facing a weird intermitent issue with the logout behavior. Same one as reported here.

Looks like there's a 50% chance for the logout request to be canceled, loosing the id_token_hint that was built in the first request and creating another one with only the post_redirect_uri, causing the workflow to fail.

image

The other 50% of the time, the first well built request is not canceled and the workflow completes succesfuly.

image

I debugged the library code to this line, where the error intermitently happens.

image

In forums people mentioned that it could be happening due to competing event listeners on the background causing the call to be canceled.

To Reproduce Steps to reproduce the behavior:

  1. Make sure to have a valid post_logout_uri configured.
  2. Login using client-secret
  3. Logout
  4. Check the console network tab to see requests being canceled.

The issue doesn't happen always so it might need a couple of tries to happen, but it is pretty frequent.

Expected behavior I expected the logout to complete without requests being canceled, completing the OIDC logout workflow.

Desktop:

Additional context I'm currently using version 15 of the angular-oauth2-oidc library along with Keycloak in its version 19.0.2.