ory / hydra

OpenID Certified™ OpenID Connect and OAuth Provider written in Go - cloud native, security-first, open source API security for your infrastructure. SDKs for any language. Works with Hardware Security Modules. Compatible with MITREid.
https://www.ory.sh/hydra/?utm_source=github&utm_medium=banner&utm_campaign=hydra
Apache License 2.0
15.27k stars 1.47k forks source link

fix: Backchannel Logout: Fix error log when RP responds with status code 204 #3731

Closed SiebelsTim closed 3 months ago

SiebelsTim commented 3 months ago

According to the specification at https://openid.net/specs/openid-connect-backchannel-1_0.html#BCResponse the Relying Party must respond with a status code 200. However, it also notes that the OpenID Provider should be prepared to handle status code 204 (No Content) as a successful response as well.

Related issue(s)

This is a previously unknown bug.

Reproduction:

  1. Configure backchannel logout
  2. The relying party responds with a 204 status code on the backchannel logout request
  3. Hydra logs an error

Note that this does not change any behaviour. The logged error does not have an influence whether the user is logged out or not.

Checklist

Further Comments

codecov[bot] commented 3 months ago

Codecov Report

Attention: Patch coverage is 0% with 2 lines in your changes are missing coverage. Please review.

Project coverage is 76.29%. Comparing base (67a85cc) to head (69cd817). Report is 2 commits behind head on master.

Files Patch % Lines
consent/strategy_default.go 0.00% 1 Missing and 1 partial :warning:
Additional details and impacted files ```diff @@ Coverage Diff @@ ## master #3731 +/- ## ======================================= Coverage 76.29% 76.29% ======================================= Files 134 134 Lines 10214 10214 ======================================= Hits 7793 7793 Misses 1904 1904 Partials 517 517 ```

:umbrella: View full report in Codecov by Sentry.
:loudspeaker: Have feedback on the report? Share it here.

SiebelsTim commented 3 months ago

I am happy that the changes were approved so quickly. Do I need to do anything else?

aeneasr commented 3 months ago

Me clicking merge, sorry :)