manfredsteyer / angular-oauth2-oidc

Support for OAuth 2 and OpenId Connect (OIDC) in Angular.
MIT License
1.86k stars 681 forks source link

Logout doesn't delete the .AspNetCore.Identity.Application cookie in the browser #1417

Closed sbma24 closed 2 days ago

sbma24 commented 1 week ago

Describe the bug The logout-function doesn't delete the .AspNetCore.Identity.Application cookie in the browser, so the user can access our angular app without logging in again.

Stackblitz example I can't deal with Stackblitz. I use you service and just tried two ways to logout:

  1. Logout with parameters

    oauthService.logOut({
    returnTo: '/Account/Login',
    client_id: 'clinet_id',
    });
  2. Logout without parameters oauthService.logOut();

Expected behavior .AspNetCore.Identity.Application cookie is deleted when the user is logging out

Desktop (please complete the following information):

sbma24 commented 1 week ago

I found out why it doesn't work. The cookie isn't deleted/removed, because of the straight redirection to the login-page after I log out the user. If I remove the redirectUri my app is broken, because the redirection doesn't work anymore,

  authConfig: AuthConfig = {
    issuer: process.env['NX_ISSUER'],
    logoutUrl: process.env['NX_ISSUER'] + '/BaseAccount/Login',
    redirectUri: window.location.origin,
    silentRefreshRedirectUri: process.env['NX_ISSUER'] + '/silent-refresh.html',
    postLogoutRedirectUri: process.env['NX_ISSUER'] + '/BaseAccount/Login',
    clientId: 'test',
    scope: 'openid profile authApi coreApi IdentityServerApi offline_access email',
    responseType: 'code',
    requireHttps: false,
    oidc: true,
  }; 

I don't know how I can fix this, because I use the redirectUri after the user is successfully logged in to redirect him to the Redirect-Component. How can i fix this?