Skip to content

Need to customize Internal logout URL used during back channel logout #14609

Closed
@pzgadzaj

Description

@pzgadzaj

Expected Behavior

OidcBackChannelLogoutHandler should be able to logout user's session using http://localhost... host and protocol

Current Behavior

In Spring security config 6.2.1, The URL which is being used for the internal logout is taken out of incoming Request: https://github.com/spring-projects/spring-security/blob/6.2.1/config/src/main/java/org/springframework/security/config/annotation/web/configurers/oauth2/client/OidcBackChannelLogoutHandler.java#L110

Context

I'm developing project in which we deploy Spring based related service on Kubernetes. We use HTTPS, however, It's being terminated on Istio ingress, so the traffic which reaches the POD with Spring service does not use HTTPS.

This causes that requestURL from the request is in shape of "https://service.domain.name/....

The only solution for me at the moment is to make a copy of OidcBackChannelLogoutHandler which will use "http://localhost:8080... convention (default port)

Metadata

Metadata

Assignees

Labels

in: oauth2An issue in OAuth2 modules (oauth2-core, oauth2-client, oauth2-resource-server, oauth2-jose)type: bugA general bug

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions