Remove the session cookie if ID token verification failed

quarkusio · Mar 23, 2023 · 25b68f0 · 25b68f0
1 parent 611f79f
commit 25b68f0
Show file tree

Hide file tree

Showing 2 changed files with 19 additions and 2 deletions.
diff --git a/...sions/oidc/runtime/src/main/java/io/quarkus/oidc/runtime/CodeAuthenticationMechanism.java b/...sions/oidc/runtime/src/main/java/io/quarkus/oidc/runtime/CodeAuthenticationMechanism.java
@@ -321,8 +321,9 @@ public Uni<? extends SecurityIdentity> apply(Throwable t) {
 
                                             if (!expired) {
                                                 LOG.errorf("ID token verification failure: %s", t.getCause());
-                                                return Uni.createFrom()
-                                                        .failure(new AuthenticationCompletionException(t.getCause()));
+                                                return removeSessionCookie(context, configContext.oidcConfig)
+                                                        .replaceWith(Uni.createFrom()
+                                                                .failure(new AuthenticationCompletionException(t.getCause())));
                                             }
                                             // Token has expired, try to refresh
                                             if (session.getRefreshToken() == null) {

diff --git a/integration-tests/oidc-code-flow/src/test/java/io/quarkus/it/keycloak/CodeFlowTest.java b/integration-tests/oidc-code-flow/src/test/java/io/quarkus/it/keycloak/CodeFlowTest.java
@@ -564,6 +564,22 @@ public void testIdTokenInjection() throws IOException {
             page = webClient.getPage("http://localhost:8081/web-app");
 
             assertEquals("alice", page.getBody().asNormalizedText());
+
+            Cookie sessionCookie = getSessionCookie(webClient, null);
+            assertNotNull(sessionCookie);
+            webClient.getCookieManager().clearCookies();
+            webClient.getCookieManager().addCookie(new Cookie(sessionCookie.getDomain(), sessionCookie.getName(),
+                    "1|2|3"));
+            sessionCookie = getSessionCookie(webClient, null);
+            assertEquals("1|2|3", sessionCookie.getValue());
+
+            try {
+                webClient.getPage("http://localhost:8081/web-app");
+                fail("401 status error is expected");
+            } catch (FailingHttpStatusCodeException ex) {
+                assertEquals(401, ex.getStatusCode());
+                assertNull(getSessionCookie(webClient, null));
+            }
             webClient.getCookieManager().clearCookies();
         }
     }