ASP.NET logout redirect not working?

[cocoon]

I tested the following example from Microsoft:
https://learn.microsoft.com/en-us/aspnet/core/blazor/security/blazor-web-app-with-oidc?view=aspnetcore-8.0&pivots=without-bff-pattern

And got nearly everything to work like expected, only the logout stops on a white page and does not automatically redirect.

I found a working workaround, so I could live with that but maybe it is something that can be fixed:
the working workaround and maybe the root cause written here:
https://stackoverflow.com/a/58965126

the .net core handler for /signout-callback-oidc relies on having the state parameter available in order to redirect

In Short:

Is there a state parameter available?

I am still trying to find out how I can verify this and where in rauthy code it is set, so I thought I might ask here already.

More info

The check, where it seems to look for the state is here:
https://github.com/dotnet/aspnetcore/blob/4fa5a228cfeb52926b30a2741b99112a64454b36/src/Security/Authentication/OpenIdConnect/src/OpenIdConnectHandler.cs#L282

The orig example for the server part I use is here:
https://github.com/dotnet/blazor-samples/blob/main/8.0/BlazorWebAppOidc/BlazorWebAppOidc/Program.cs

If needed I could post the full modified Blazor project how it is working with rauthy, as the default will not work out of the box.

[sebadob]

only the logout stops on a white page and does not automatically redirect

Is that a white page from Rauthy or your App?

Is there a state parameter available?

Yes:

rauthy/src/api/src/oidc.rs

Line 675 in ac8435b

if params.post_logout_redirect_uri.is_some() {

[cocoon]

Ah thanks for the code line!
Then I can have a look there.

It is from my app.
And to be honest, I think it might be something in the app.

It gets stuck at the logout page:
https://localhost:5001/signout-callback-oidc

The client in rauthy is configured with:

Redirect Uri:
https://localhost:5001/signin-oidc

Post logout Redirect Uri:
https://localhost:5001/signout-callback-oidc

The logout method in the app ist:
group.MapPost("/logout", ([FromForm] string? returnUrl) => TypedResults.SignOut(GetAuthProperties(returnUrl), [CookieAuthenticationDefaults.AuthenticationScheme, "MicrosoftOidc"]));

So I think the "post logout redirect" should be something else.
Interestingly if I set it to:
https://localhost:5001/

I will not end there, instead I end up at ratuhy:
https://localhost:8443/auth/v1/

[cocoon]

Oh I might have to add something here:

https://github.com/dotnet/blazor-samples/blob/main/8.0/BlazorWebAppOidc/BlazorWebAppOidc/LoginLogoutEndpointRouteBuilderExtensions.cs#L28

It looks like hardcoded to "/" currently, will give it a try ^^

[cocoon]

I added Tracing all over the code and found out that the line you linked where the state is set to was never hit.

The difference is: you linked to the POST method.
BTW Maybe the comment is wrong here:

rauthy/src/api/src/oidc.rs

Line 645 in ac8435b

/// This is the corresponding endpoint for the `GET /auth/v1/oidc/logout`

But my app seems to use the GET method and there no state was set:

rauthy/src/api/src/oidc.rs

Line 606 in ac8435b

#[get("/oidc/logout")]

I added the state code to the GET method
and currently set the returnUrl in GetAuthProperties fixed to
"return new AuthenticationProperties { RedirectUri = "https://localhost:5001" };"

now it seems to work.

But the question is now:
Is the app using the wrong method or should a state added to the GET method, too?

[sebadob]

Well, the question is, are you trying to do a backchannel logout over a front channel logout here? The GET only returns the HTML page, which then uses the POST (the doc comment is correct) for the actual logout.

You need to redirect the user to the GET endpoint, where depending on if you have given an id_token_hint another consent is needed, or the logout will be automatic. You can't and in fact must not use the GET directly. It's missing the additional CSRF token check which degrades your security.

[sebadob]

The GET does not do anything else than validating the current session and then returning the HTML page. It does not log you out or invalidate anything.

[cocoon]

Thank you very much for your hints!
I see the GET should use the POST to do the work here if all is OK.

Now I have some ideas where to look and will try to figure out more.

Currently I seem to be stuck here:

rauthy/src/service/src/oidc/logout.rs

Line 61 in 29f5202

if valid_redirect.count() == 0 {

the count seems not to work, but I need to check more ..

rauthy_service::oidc::logout valid_redirect:
rauthy_service::oidc::logout Filter {
iter: Iter(
[
"https://win10pro.lab:5001/",
],
),
}
rauthy_service::oidc::logout [ERROR] valid_redirect.count() == 0

[sebadob]

Currently I seem to be stuck here

Just to keep in mind, something like https://win10pro.lab:5001/ would fail if you redirect to just https://win10pro.lab:5001.
You also have the wildcard * available, as long at it's at the end of your URI, like https://win10pro.lab:5001/* for instance.

[cocoon]

That was a missing part!!

with the * it is seen as valid now and redirects to this target and gets stuck at "/signout-callback-oidc" but I want it to redirect to "/" but now I might be able to figure this out and might need to set it in my app:

�[2m2025-01-06T14:10:41.543340Z�[0m �[35mTRACE�[0m �[2mrauthy_service::oidc::logout�[0m�[2m:�[0m target:
�[2m2025-01-06T14:10:41.543361Z�[0m �[35mTRACE�[0m �[2mrauthy_service::oidc::logout�[0m�[2m:�[0m "https://win10pro.lab:5001/signout-callback-oidc"
�[2m2025-01-06T14:10:41.543375Z�[0m �[35mTRACE�[0m �[2mrauthy_service::oidc::logout�[0m�[2m:�[0m uri_vec:
�[2m2025-01-06T14:10:41.543388Z�[0m �[35mTRACE�[0m �[2mrauthy_service::oidc::logout�[0m�[2m:�[0m Some(
    [
        "https://win10pro.lab:5001/*",
    ],
)
�[2m2025-01-06T14:10:41.543410Z�[0m �[35mTRACE�[0m �[2mrauthy_service::oidc::logout�[0m�[2m:�[0m valid_redirect:
�[2m2025-01-06T14:10:41.543426Z�[0m �[35mTRACE�[0m �[2mrauthy_service::oidc::logout�[0m�[2m:�[0m Filter {
    iter: Iter(
        [
            "https://win10pro.lab:5001/*",
        ],
    ),
}
�[2m2025-01-06T14:10:41.543465Z�[0m �[35mTRACE�[0m �[2mrauthy_service::oidc::logout�[0m�[2m:�[0m #### redirect uri is valid at this point ####
�[2m2025-01-06T14:10:41.543491Z�[0m �[35mTRACE�[0m �[2mrauthy_models::templates�[0m�[2m:�[0m #### LogoutHtml::build ####