Comments (2)
robotdan
commented on August 20, 2024
It looks like you may be making the request to /oauth2/logout in code and not in the User Agent. Is that correct?
If that is correct, I would expect this to fail. The /oauth2/logout request will attempt to remove the SSO session cookie, but this cookie is a secure HTTP only cookie. So if you make this request from within code, it is effectively a cross origin request, and we will not have visibility to the SSO session, and as a result the session will not be revoked.
The only way to use the /oauth2/logout endpoint and have it revoke the SSO session is to make it in the User Agent in a first-party context.
To logout via code is considered a back channel logout. We don't directly publish a back channel logout mechanism through OAuth2, but you can always use the Refresh Token APIs to revoke session tokens which accomplishes this goal.
from fusionauth-issues.
robotdan
commented on August 20, 2024
If you think there is a bug here, please re-open. Thanks!
from fusionauth-issues.
Related Issues (20)
- vulnerability reported on *.js.map and *.css.map files HOT 1
- Bundle JS files in fusionauth-app using webpack
- [Bug]: Device Grant type not listed in acceptable grant types when posting to the /oauth2/token endpoint
- Show list of trusted devices
- [Bug]: POST Bindings not honored in managed domains with SAML IdP
- Update deps for 1.53.0
- IFRAME Support with Hosted Pages HOT 1
- Allow a user to start a free trial without supplying a credit card
- Passwordless login API verify code stage issue (/api/passwordless/login endpoint) HOT 4
- Add More Functionality to Simple Theme Editor
- SCIM Patch does not properly handle removing from array
- Allow CAPTCHA to be turned off at the application level
- Import API fails to provide validation message for non-existent group
- Add an API for managing FusionAuth Cloud deployments
- [Bug]: Prompted to resubmit form on Firefox when first logging in to new deployment
- [Bug]: Manage Users display of User Data does not show booleans
- [Bug]: /api/user/search POST request ignores the expand property HOT 2
- Kickstart Service does not allow a reference to the `defaultselfServiceFormId`
- [Bug]: Unable to see any Provider, when an OIDC Discover URL don't work HOT 2
- [Bug]: Event Log advanced search decreases start/end datetimes on every search
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from fusionauth-issues.