Document session logout for OIDC and app-native flows - #4291
Document session logout for OIDC and app-native flows#4291madurangasiriwardena wants to merge 1 commit into
Conversation
madurangasiriwardena
added
the
skip-changelog
📝 WalkthroughWalkthroughThe PR documents RP-Initiated Logout, adds sign-out flow creation and session termination guidance, introduces a logout flow diagram, and expands the Flow Execution API to accept and demonstrate ChangesSign-out flow support
Estimated code review effort: 3 (Moderate) | ~20 minutes Sequence Diagram(s)sequenceDiagram
participant Application
participant OAuth2LogoutEndpoint
participant SignOutFlow
Application->>OAuth2LogoutEndpoint: Redirect to /oauth2/logout with logout parameters
OAuth2LogoutEndpoint->>OAuth2LogoutEndpoint: Validate logout request
OAuth2LogoutEndpoint->>SignOutFlow: Execute configured sign-out flow
SignOutFlow-->>OAuth2LogoutEndpoint: Confirm session termination
OAuth2LogoutEndpoint-->>Application: Redirect to post_logout_redirect_uri with state
Possibly related PRs
Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Warning There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure. 🔧 ESLint
docs/content/guides/flows/advanced-configurations.mdxESLint skipped: missing config or dependency (missing-dependency). The ESLint configuration references a package that is not available in the sandbox. docs/content/guides/flows/build-a-flow.mdxESLint skipped: the ESLint configuration for this file references a package that is not available in the sandbox. Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🧹 Nitpick comments (1)
docs/src/components/OAuthFlowDiagrams.tsx (1)
204-204: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winIs this hardcoded brand name intentional?
Line [204] embeds
ThunderIDin theariaLabel. If branding is configurable, derive the product name from the application/Docusaurus config and interpolate it into the string rather than hardcoding it.As per path instructions, product names in
docs/srcshould come from configuration instead of raw string literals.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/src/components/OAuthFlowDiagrams.tsx` at line 204, Replace the hardcoded “ThunderID” in the RP-Initiated Logout diagram’s ariaLabel with the configured product/application name, using the existing Docusaurus or application configuration mechanism available to OAuthFlowDiagrams. Preserve the rest of the accessibility text and interpolate the resolved name into the label.Source: Path instructions
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@docs/content/guides/protocols/oauth-oidc/rp-initiated-logout.mdx`:
- Around line 40-43: Update the POST guidance in the endpoint request
documentation to avoid claiming it keeps id_token_hint out of server logs.
Describe POST as reducing query-string and browser-history exposure, and
recommend redacting id_token_hint because request bodies may still be logged by
applications, proxies, or middleware.
- Around line 21-22: The configured sign-out flow may prompt for confirmation or
use a Blank/custom flow, so make the logout documentation conditional rather
than guaranteeing a confirmation page. Update
docs/content/guides/protocols/oauth-oidc/rp-initiated-logout.mdx lines 21-22 and
101-105 to qualify the confirmation and result examples, and update
docs/src/components/OAuthFlowDiagrams.tsx lines 204-214 to remove or qualify
hard-coded confirmation steps.
- Line 22: Update the redirect behavior description in the RP-initiated logout
guide so it says <ProductName /> appends `state` only when the application
supplies it, rather than implying it is always appended. Apply the same
qualification to the related wording around the optional `state` parameter.
---
Nitpick comments:
In `@docs/src/components/OAuthFlowDiagrams.tsx`:
- Line 204: Replace the hardcoded “ThunderID” in the RP-Initiated Logout
diagram’s ariaLabel with the configured product/application name, using the
existing Docusaurus or application configuration mechanism available to
OAuthFlowDiagrams. Preserve the rest of the accessibility text and interpolate
the resolved name into the label.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: 1bb4f451-8be7-4477-9110-4c54c9df5b94
📒 Files selected for processing (7)
api/flow-execution.yamldocs/content/guides/flows/build-a-flow.mdxdocs/content/guides/protocols/oauth-oidc/index.mdxdocs/content/guides/protocols/oauth-oidc/rp-initiated-logout.mdxdocs/content/key-concepts/authentication/sessions.mdxdocs/sidebars.tsdocs/src/components/OAuthFlowDiagrams.tsx
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
315f9a8 to
27a9480
Compare
madurangasiriwardena
added
the
trigger-pr-builder
9c05e32 to
ec53a5d
Compare
Malith-19
added
documentation
Add an RP-Initiated Logout page under the OAuth & OIDC protocol guides covering the end_session_endpoint, register it in the sidebar and the protocol catalogue, describe session termination in the Sessions concept page, add a sign-out flow section to the Build a Flow guide, and add the SIGNOUT flow type to the Flow Execution API spec.
ec53a5d to
d6bb0c9
Compare
There was a problem hiding this comment.
🧹 Nitpick comments (1)
docs/content/guides/flows/advanced-configurations.mdx (1)
385-385: 🎯 Functional Correctness | 🔵 Trivial | ⚡ Quick winClarify that the executor clears the per-flow cookie.
The implementation terminates the SSO session and signals the transport layer to clear the per-flow handle cookie. Replace “its session cookie” with “the per-flow cookie” to avoid implying that the SSO session itself is represented by that cookie.
Proposed wording
-| **End Session** | Terminates the SSO session established by the authentication flow and clears its session cookie. | - | +| **End Session** | Terminates the SSO session established by the authentication flow and clears the per-flow cookie. | - |🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/content/guides/flows/advanced-configurations.mdx` at line 385, Update the “End Session” table entry to replace “its session cookie” with “the per-flow cookie,” clarifying that the executor signals transport-layer cleanup of the per-flow handle cookie while terminating the SSO session.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In `@docs/content/guides/flows/advanced-configurations.mdx`:
- Line 385: Update the “End Session” table entry to replace “its session cookie”
with “the per-flow cookie,” clarifying that the executor signals transport-layer
cleanup of the per-flow handle cookie while terminating the SSO session.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: ee61cd6c-7729-4cfd-83f0-31fcc029a979
📒 Files selected for processing (3)
api/flow-execution.yamldocs/content/guides/flows/advanced-configurations.mdxdocs/content/guides/flows/build-a-flow.mdx
🚧 Files skipped from review as they are similar to previous changes (2)
- api/flow-execution.yaml
- docs/content/guides/flows/build-a-flow.mdx
2 participants
Purpose
Adds product documentation for session logout, covering both the OIDC redirect-based path and the app-native flow path. This documents the RP-initiated logout endpoint and the sign-out flow that were added to the backend, so integrators know how to end a user's SSO session (not just their local application session).
Changes:
guides/protocols/oauth-oidc/rp-initiated-logout.mdx) covering theend_session_endpoint(GET/POST /oauth2/logout): the sequence, request methods, request parameters, validation rules, and the sign-out-flow /postLogoutRedirectUrisprerequisites. Registered in the sidebar under OIDC and added to the OAuth & OIDC index catalogue.api/flow-execution.yaml): added theSIGNOUTflow type to theflowTypeenum and a sign-out request example.Approach
SequenceDiagramcomponent (via a newRPInitiatedLogoutDiagraminOAuthFlowDiagrams.tsx), consistent with the other OAuth/OIDC pages, since Mermaid is not enabled in this repo.postLogoutRedirectUrisas configured via declarative config / the/applicationsAPI, because no Console UI currently exposes that field.Related Issues
Related PRs
Checklist
breaking changelabel added.Security checks
Summary by CodeRabbit
New Features
Documentation