3085309 · typeable/oauth2-proxy

git.iko.soy/typeable/oauth2-proxy

feat: possibility to inject id_token in redirect url during sign out (#3278)

* feat: possibility to inject id_token in redirect url during sign out Signed-off-by: Alban Fonrouge <alban.fonrouge@visma.com> * doc: changelog for #3278 Signed-off-by: Jan Larwig <jan@larwig.com> * test: fix assertion for TestIdTokenPlaceholderInSignOut Signed-off-by: Jan Larwig <jan@larwig.com> --------- Signed-off-by: Alban Fonrouge <alban.fonrouge@visma.com> Signed-off-by: Jan Larwig <jan@larwig.com> Co-authored-by: Jan Larwig <jan@larwig.com>

commit30853098c71dd4088bff9eb4069e7c6e7cee9ef8 authorAlban Fonrouge <alban.fonrouge@visma.com> dateWed 18 Mar 2026, 13:19 (6 months ago) parent8cb06b7

4 files changed+75−1

compare with master

unifiedsplit

CHANGELOG.md+1 docs/docs/features/endpoints.md+14 oauthproxy.go+13−1 oauthproxy_test.go+47

CHANGELOG.md+1

@@ -11,6 +11,7 @@

1111- [#3352](https://github.com/oauth2-proxy/oauth2-proxy/pull/3352) fix: backend logout URL call on sign out (#3172)(@vsejpal)

1212- [#3332](https://github.com/oauth2-proxy/oauth2-proxy/pull/3332) ci: distribute windows binary with .exe extension (@igitur)

1313- [#2685](https://github.com/oauth2-proxy/oauth2-proxy/pull/2685) feat: allow arbitrary claims from the IDToken and IdentityProvider UserInfo endpoint to be added to the session state (@vegetablest)

14+- [#3278](https://github.com/oauth2-proxy/oauth2-proxy/pull/3278) feat: possibility to inject id_token in redirect url during sign out (@albanf)

1415

1516# V7.14.3

1617

docs/docs/features/endpoints.md+14

@@ -38,6 +38,20 @@ X-Auth-Request-Redirect: https://my-oidc-provider/sign_out_page

3838

3939BEWARE that the domain you want to redirect to (`my-oidc-provider.example.com` in the example) must be added to the [`--whitelist-domain`](../configuration/overview) configuration option otherwise the redirect will be ignored. Make sure to include the actual domain and port (if needed) and not the URL (e.g "localhost:8081" instead of "http://localhost:8081").

4040

41+ID Token can be injected in the redirect url by using `{id_token}` placeholder. For example to redirect to `https://my-oidc-provider.example.com/sign_out_page?id_token_hint={id_token}&post_logout_redirect_uri=https://my-app.example.com`;

42+

43+```

44+/oauth2/sign_out?rd=https%3A%2F%2Fmy-oidc-provider.example.com%2Fsign_out_page%3Fid_token_hint%3D%7Bid_token%7D%26post_logout_redirect_uri%3Dhttps%3A%2F%2Fmy-app.example.com

45+```

46+

47+or alternatively in the header:

48+

49+```

50+GET /oauth2/sign_out HTTP/1.1

51+X-Auth-Request-Redirect: https://my-oidc-provider.example.com/sign_out_page?id_token_hint={id_token}&post_logout_redirect_uri=https://my-app.example.com

52+...

53+```

54+

4155### Auth

4256

4357This endpoint returns 202 Accepted response or a 401 Unauthorized response.

oauthproxy.go+13−1

@@ -54,6 +54,8 @@ const (

5454 authOnlyPath = "/auth"

5555 userInfoPath = "/userinfo"

5656 staticPathPrefix = "/static/"

57+

58+ idTokenPlaceholder = "{id_token}"

5759)

5860

5961var (

@@ -748,6 +750,16 @@ func (p *OAuthProxy) SignOut(rw http.ResponseWriter, req *http.Request) {

748750 p.ErrorPage(rw, req, http.StatusInternalServerError, err.Error())

749751 return

750752 }

753+

754+ if strings.Contains(redirect, idTokenPlaceholder) {

755+ session, err := p.getAuthenticatedSession(rw, req)

756+ if err != nil {

757+ logger.Errorf("error getting authenticated session during SignOut, won't replace id_token placeholder in redirect URL: %v", err)

758+ } else {

759+ redirect = strings.ReplaceAll(redirect, idTokenPlaceholder, session.IDToken)

760+ }

761+ }

762+

751763 // Call backend logout before clearing the session so we still have the session

752764 // (and id_token) available to invoke the provider's logout endpoint

753765 p.backendLogout(rw, req)

@@ -778,7 +790,7 @@ func (p *OAuthProxy) backendLogout(rw http.ResponseWriter, req *http.Request) {

778790 return

779791 }

780792

781− backendLogoutURL := strings.ReplaceAll(providerData.BackendLogoutURL, "{id_token}", session.IDToken)

793+ backendLogoutURL := strings.ReplaceAll(providerData.BackendLogoutURL, idTokenPlaceholder, session.IDToken)

782794 // security exception because URL is dynamic ({id_token} replacement) but

783795 // base is not end-user provided but comes from configuration somewhat secure

784796 resp, err := http.Get(backendLogoutURL) // #nosec G107

oauthproxy_test.go+47

@@ -15,6 +15,7 @@ import (

1515 "time"

1616

1717 "github.com/coreos/go-oidc/v3/oidc"

18+ middlewareapi "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/apis/middleware"

1819 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/apis/options"

1920 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/apis/sessions"

2021 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/authentication/hmacauth"

@@ -3583,3 +3584,49 @@ func TestGetOAuthRedirectURI(t *testing.T) {

35833584 })

35843585 }

35853586}

3587+

3588+func TestIdTokenPlaceholderInSignOut(t *testing.T) {

3589+ opts := baseTestOptions()

3590+ opts.WhitelistDomains = []string{"my-oidc-provider.example.com"}

3591+

3592+ err := validation.Validate(opts)

3593+ assert.NoError(t, err)

3594+

3595+ const emailAddress = "john.doe@example.com"

3596+ const userName = "9fcab5c9b889a557"

3597+ created := time.Now()

3598+

3599+ session := &sessions.SessionState{

3600+ User: userName,

3601+ Groups: []string{"a", "b"},

3602+ Email: emailAddress,

3603+ IDToken: "eYjjjjjj.vvvv.ddd",

3604+ AccessToken: "oauth_token",

3605+ CreatedAt: &created,

3606+ }

3607+

3608+ proxy, err := NewOAuthProxy(opts, func(email string) bool {

3609+ return true

3610+ })

3611+ assert.NoError(t, err)

3612+

3613+ // Save the required session

3614+ rw := httptest.NewRecorder()

3615+ req, _ := http.NewRequest("GET", "/", nil)

3616+ err = proxy.sessionStore.Save(rw, req, session)

3617+ assert.NoError(t, err)

3618+

3619+ rw = httptest.NewRecorder()

3620+

3621+ rdUrl := url.QueryEscape("https://my-oidc-provider.example.com/sign_out_page?id_token_hint={id_token}&post_logout_redirect_uri=https://my-app.example.com/")

3622+ req, _ = http.NewRequest("GET", "/oauth2/sign_out?rd="+rdUrl, nil)

3623+ req = middlewareapi.AddRequestScope(req, &middlewareapi.RequestScope{

3624+ RequestID: "11111111-2222-4333-8444-555555555555",

3625+ Session: session,

3626+ })

3627+

3628+ proxy.SignOut(rw, req)

3629+ newLocation := rw.Header().Values("Location")[0]

3630+

3631+ assert.Equal(t, "https://my-oidc-provider.example.com/sign_out_page?id_token_hint=eYjjjjjj.vvvv.ddd&post_logout_redirect_uri=https://my-app.example.com/", newLocation)

3632+}