Logout handles GET /api/v1/auth/oidc/logout.
(w http.ResponseWriter, r *http.Request)
| 613 | |
| 614 | // Logout handles GET /api/v1/auth/oidc/logout. |
| 615 | func (h *OidcHandler) Logout(w http.ResponseWriter, r *http.Request) { |
| 616 | h.clientMu.RLock() |
| 617 | client := h.client |
| 618 | h.clientMu.RUnlock() |
| 619 | |
| 620 | if client == nil { |
| 621 | http.Redirect(w, r, h.cfg.OidcPostLogoutURI, http.StatusFound) |
| 622 | return |
| 623 | } |
| 624 | var idTokenHint string |
| 625 | if userID, _ := r.Context().Value(middleware.UserIDKey).(string); userID != "" { |
| 626 | idTokenHint, _ = h.oidcStore.GetAndDeleteIDToken(r.Context(), userID) |
| 627 | } |
| 628 | clearAuthCookies(w, r) |
| 629 | // Path must match how the cookie was set in Login handler. |
| 630 | http.SetCookie(w, &http.Cookie{Name: "oidc_state", Value: "", Path: "/api/v1/auth/oidc", MaxAge: -1, HttpOnly: true, Secure: isSecureRequest(r)}) |
| 631 | logoutURL := client.LogoutURL(h.cfg.OidcPostLogoutURI, idTokenHint, h.oidcClientID()) |
| 632 | if logoutURL != "" { |
| 633 | http.Redirect(w, r, logoutURL, http.StatusFound) |
| 634 | } else { |
| 635 | http.Redirect(w, r, h.cfg.OidcPostLogoutURI, http.StatusFound) |
| 636 | } |
| 637 | } |
| 638 | |
| 639 | func (h *OidcHandler) requireHTTPS(w http.ResponseWriter, r *http.Request) bool { |
| 640 | h.clientMu.RLock() |
nothing calls this directly
no test coverage detected