Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

LG-7434: Allow cross origin for POST OIDC Logout #10697

Merged
merged 9 commits into from
May 30, 2024
Merged

LG-7434: Allow cross origin for POST OIDC Logout #10697

merged 9 commits into from
May 30, 2024

Commits on May 29, 2024

  1. LG-7434: Allow cross origin for POST OIDC Logout 

    **Why**:

- It is expected that requests will be made by relying parties on external domains

- The specification for OpenID Connect RP-Initiated Logout 1.0 requires
  both HTTP `GET` and `POST` methods to be supported.
  See: https://openid.net/specs/openid-connect-rpinitiated-1_0.html#RPLogout

- Data sent using the `POST` method remains encrypted during transport in the
  browser and in web application logs, preventing leakage of sensitive
  information

**How**:

- The same endpoint shall be used, `/openid_connect/logout`, but the
  request data must be sent as part of the body and use form
  serialization as required for  HTTP `POST` requests (RFC 9110, sec. 9.3.3).

- Disables Rail's CSRF token verification for the POST route only

resolves https://gitlab.login.gov/lg-people/lg-people-appdev/protocols/openid-connect/-/issues/3

changelog: Bug Fixes, Security, Fix CORS stopping POST for OIDC RP-Initiated Logout 1.0
    @lmgeorge
    lmgeorge committed May 29, 2024
    Configuration menu
    Copy the full SHA
    f1f17a1 View commit details
    Browse the repository at this point in the history

  2. make rubocop happy

    @lmgeorge
    lmgeorge committed May 29, 2024
    Configuration menu
    Copy the full SHA
    5f4f15d View commit details
    Browse the repository at this point in the history

  3. PR!10697 feedback: clean up comments and YARD annotations

    @lmgeorge
    lmgeorge committed May 29, 2024
    Configuration menu
    Copy the full SHA
    c816232 View commit details
    Browse the repository at this point in the history

  4. PR!10697 feedback: removed status code changes and updated doc strings

    @lmgeorge
    lmgeorge committed May 29, 2024
    Configuration menu
    Copy the full SHA
    db3a8c1 View commit details
    Browse the repository at this point in the history

  5. PR!10697 feedback: redirect from POST to GET to prevent browser ERR_C… 

    …ACHE_MISS on navigation
    @lmgeorge
    lmgeorge committed May 29, 2024
    Configuration menu
    Copy the full SHA
    9d68447 View commit details
    Browse the repository at this point in the history

  6. PR!10697 feedback: added original_method field to analytics event

    @lmgeorge
    lmgeorge committed May 29, 2024
    Configuration menu
    Copy the full SHA
    7973510 View commit details
    Browse the repository at this point in the history

  7. PR!10697 feedback: use session instead of flash

    @lmgeorge
    lmgeorge committed May 29, 2024
    Configuration menu
    Copy the full SHA
    9fb6004 View commit details
    Browse the repository at this point in the history

  8. PR#10697 feedback: set event props directly on session instead of usi… 

    …ng a hash
    @lmgeorge
    lmgeorge committed May 29, 2024
    Configuration menu
    Copy the full SHA
    e7f2e4b View commit details
    Browse the repository at this point in the history

  9. PR!10697: fixing broken analytics tests

    @lmgeorge
    lmgeorge committed May 29, 2024
    Configuration menu
    Copy the full SHA
    1844136 View commit details
    Browse the repository at this point in the history