vuex-oidc: Silent sign-out does not invalidate session cookies
I am trying to get my webapp to silently sign-out without going through the IdP (Keycloak) by calling unsetOidcAuth.
This results in the app state being reset correctly, however it appears that the session cookies created by the IdP at login time are not being removed, causing an “auto-signin” event (no authentication page from the IdP is displayed) when accessing the application a second time.
The session cookies are not available in the context of the application, so I am unable to reset them programmatically after calling unsetOidcAuth, and performing a sign-out using signOutOidc triggers a redirect to the application landing page (as configured in the OIDC settings).
Is it possible to completely destroy the authentication session on the client, without going through the IdP?
If not, could signOutOidc accept a redirect_uri so that its behaviour could be customized depending on where the sign-out action is triggered from?
About this issue
- Original URL
- State: closed
- Created 4 years ago
- Comments: 16 (9 by maintainers)
@perarnborg yup, that seems to have done it. Dispatching
signOutOidcSilentremoves the user from storage and kills the active session so any request to resources that require authentication will now trigger a new login flow. Thanks!Ok I have an idea of what can be missing in my implementation. I will provide a patch as soon as I can.
Silent signout at the provider is not yet supported. It has been suggested to add support (#57) but I am not sure when I will have the time to look at that.