search

poppinss / oauth-client

A framework agnostic package to implement "Login with" flow using OAuth compliant authorization servers
MIT License
23 stars 2 forks source link

Support for the ability to end the user's session at the IdP / AS #6

Open ThisIsMissEm opened 2 months ago

ThisIsMissEm commented 2 months ago

One of the available endpoints on an OAuth 2, or OIDC, server is the ability to end the users' session and revoke the users' current access token. This is described in RFC7009. You can discover support for this via the revocation_endpoint related properties found via #4 in OAuth.

In OIDC, the property is end_session_endpoint, defined here: OpenID Connect RP-Initiated Logout 1.0, there's additionally a back-channel logout method, which is defined in OpenID Connect Back-Channel Logout 1.0. The difference between the two is that in RP-Initiated Logout, there's a redirect flow, much like the flow used during authorization code grant flow, in Back-Channel Logout, the logout is performed via an API request with a "logout token".

In this package, that'd mean implementing in the OAuth2Client a getLogoutUrl that is similar to getRedirectUrl, where you'll also have a redirect_uri parameter to return the user back to your application (RP) once logged out.

stale[bot] commented 3 days ago

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

ThisIsMissEm commented 3 days ago

Still relevant. @RomainLanz can we keep open this and the other ticket? https://github.com/poppinss/oauth-client/issues/4