search

schibsted / account-sdk-browser

Schibsted Account SDK for browsers
https://schibsted.github.io/account-sdk-browser/
MIT License
16 stars 11 forks source link

doc: Clarify that Identity.logout() validates CORS #36

Closed torarvid closed 6 years ago

torarvid commented 6 years ago

During the 2.5 hours when a site went live yesterday, we saw some errors that the logout() requests were failing. This was because they were calling it from a http origin, and only the https origin was listed in redirect_uris.

codecov[bot] commented 6 years ago

Codecov Report

Merging #36 into master will not change coverage. The diff coverage is n/a.

Impacted file tree graph

@@         Coverage Diff          @@
##           master   #36   +/-   ##
====================================
  Coverage      94%   94%           
====================================
  Files          14    14           
  Lines         400   400           
  Branches       83    83           
====================================
  Hits          376   376           
  Misses         23    23           
  Partials        1     1
Impacted Files Coverage Δ
src/identity.js 90.97% <ø> (ø) :arrow_up:

Continue to review full report at Codecov.

Legend - Click here to learn more Δ = absolute <relative> (impact), ø = not affected, ? = missing data Powered by Codecov. Last update 31336a0...0d4298f. Read the comment docs.

vasklund commented 6 years ago

I found this now, but it doesn't seem to exist in master anymore? Does this still hold true?

torarvid commented 6 years ago

Nope, since ITP2, we do full-page redirect to the logout flow in Schibsted account

vasklund commented 6 years ago

Oh, right, I should have known that! 😄

It would be nice if it was documented that you still need to have a URL in SelfService where the origin (protocol + domain) matches where you are redirecting back to (in Identity.logout(<redirectUri>)) - it took us a couple of hours of error and trial to figure that one out.