Method LogoutHandler

internal/http_handlers/logout.go:30–174

Handler to logout user

()

// Handler to logout user
func (h *httpProvider) LogoutHandler() gin.HandlerFunc {
	log := h.Log.With().Str("func", "LogoutHandler").Logger()
	return func(gc *gin.Context) {
		// OIDC RP-initiated logout uses GET on the end_session_endpoint.
		// Without protection, an attacker can place <img src="/logout">
		// on a page they control and the victim's browser will silently
		// terminate their session via the cookie. Defence-in-depth:
		//
		//   - GET with id_token_hint  → proceed (the ID token proves the
		//     request originates from a real authenticated session — an
		//     <img> tag cannot forge an ID token)
		//   - GET without id_token_hint → render an HTML confirmation
		//     page; only the POST that follows actually deletes the
		//     session
		//   - POST → proceed unconditionally (existing behaviour; CSRF
		//     middleware enforces Origin/Referer for all POSTs)
		if gc.Request.Method == http.MethodGet {
			idTokenHint := strings.TrimSpace(gc.Query("id_token_hint"))
			if idTokenHint == "" || !h.isValidIDTokenHint(idTokenHint) {
				log.Debug().Bool("had_hint", idTokenHint != "").Msg("serving logout confirmation page")
				gc.Header("Cache-Control", "no-store")
				gc.HTML(http.StatusOK, logoutConfirmTemplate, gin.H{
					"redirect_uri":             gc.Query("redirect_uri"),
					"post_logout_redirect_uri": gc.Query("post_logout_redirect_uri"),
					"state":                    gc.Query("state"),
				})
				return
			}
			// Valid id_token_hint — fall through to the normal logout flow.
		}

		// OIDC RP-Initiated Logout 1.0 §3 uses post_logout_redirect_uri.
		// Fall back to the legacy redirect_uri for backward compatibility.
		redirectURL := strings.TrimSpace(gc.Query("post_logout_redirect_uri"))
		if redirectURL == "" {
			redirectURL = strings.TrimSpace(gc.PostForm("post_logout_redirect_uri"))
		}
		if redirectURL == "" {
			redirectURL = strings.TrimSpace(gc.Query("redirect_uri"))
		}
		if redirectURL == "" {
			redirectURL = strings.TrimSpace(gc.PostForm("redirect_uri"))
		}

		// state, when present, MUST be echoed on the final redirect per
		// OIDC RP-Initiated Logout §3.
		state := strings.TrimSpace(gc.Query("state"))
		if state == "" {
			state = strings.TrimSpace(gc.PostForm("state"))
		}
		// get fingerprint hash
		fingerprintHash, err := cookie.GetSession(gc)
		if err != nil {
			log.Debug().Err(err).Msg("failed GetSession")
			gc.JSON(http.StatusUnauthorized, gin.H{
				"error": "unauthorized",
			})
			return