Skip to content

fix(consent): use GetLoginSession in logout handlers to handle remember=false sessions #4119

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
waterWang wants to merge 3 commits into
base: master
Choose a base branch
from
Open

fix(consent): use GetLoginSession in logout handlers to handle remember=false sessions #4119

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
47528fc
fix(consent): add GetLoginSession to LoginManager interface
waterWang Aug 6, 2026
4584c82
fix(persistence): add GetLoginSession without remember=TRUE filter
waterWang Aug 6, 2026
06d9c55
fix(consent): use GetLoginSession in logout handlers to handle rememb…
waterWang Aug 6, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions consent/manager.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -52,6 +52,7 @@ type (
}
LoginManager interface {
GetRememberedLoginSession(ctx context.Context, id string) (*flow.LoginSession, error)
GetLoginSession(ctx context.Context, id string) (*flow.LoginSession, error)
DeleteLoginSession(ctx context.Context, id string) (deletedSession *flow.LoginSession, err error)
RevokeSubjectLoginSession(ctx context.Context, subject string) error
ConfirmLoginSession(ctx context.Context, loginSession *flow.LoginSession) error
Expand Down
4 changes: 2 additions & 2 deletions consent/strategy_default.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -939,7 +939,7 @@ func (s *defaultStrategy) issueLogoutVerifier(ctx context.Context, w http.Respon

// We do not really want to verify if the user (from id token hint) has a session here because it doesn't really matter.
// Instead, we'll check this when we're actually revoking the cookie!
session, err := s.r.LoginManager().GetRememberedLoginSession(ctx, hintSid)
session, err := s.r.LoginManager().GetLoginSession(ctx, hintSid)
if errors.Is(err, x.ErrNotFound) {
// Such a session does not exist - maybe it has already been revoked? In any case, we can't do much except
// leaning back and redirecting back.
Expand Down Expand Up @@ -1096,7 +1096,7 @@ func (s *defaultStrategy) HandleOpenIDConnectLogout(ctx context.Context, w http.
}

func (s *defaultStrategy) HandleHeadlessLogout(ctx context.Context, _ http.ResponseWriter, r *http.Request, sid string) error {
loginSession, lsErr := s.r.LoginManager().GetRememberedLoginSession(ctx, sid)
loginSession, lsErr := s.r.LoginManager().GetLoginSession(ctx, sid)

if errors.Is(lsErr, x.ErrNotFound) {
// This is ok (session probably already revoked), do nothing!
Expand Down
14 changes: 14 additions & 0 deletions persistence/sql/persister_consent.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -240,6 +240,20 @@ func (p *Persister) GetRememberedLoginSession(ctx context.Context, id string) (_
return &s, nil
}

func (p *Persister) GetLoginSession(ctx context.Context, id string) (_ *flow.LoginSession, err error) {
ctx, span := p.r.Tracer(ctx).Tracer().Start(ctx, "persistence.sql.GetLoginSession")
defer otelx.End(span, &err)

var s flow.LoginSession
if err := p.QueryWithNetwork(ctx).Find(&s, id); errors.Is(err, sql.ErrNoRows) {
return nil, errors.WithStack(x.ErrNotFound)
} else if err != nil {
return nil, sqlcon.HandleError(err)
}

return &s, nil
}

// ConfirmLoginSession creates or updates the login session. The NID will be set to the network ID of the context.
func (p *Persister) ConfirmLoginSession(ctx context.Context, loginSession *flow.LoginSession) (err error) {
ctx, span := p.r.Tracer(ctx).Tracer().Start(ctx, "persistence.sql.ConfirmLoginSession")
Expand Down
Loading