OIDC RP-Initiated Logout: SPA does not follow 303 redirect after POST /oidc/session/end/confirm #418

New issue

Open

opened 2026-05-15 09:38:24 -05:00 by Banzzouille · 1 comment

Banzzouille commented

2026-05-15 09:38:24 -05:00

(Migrated from github.com)

Description

When using RP-Initiated Logout (/oidc/session/end), the VoidAuth SPA logout confirmation page (/logout/<id>) does not follow the 303 redirect returned by POST /oidc/session/end/confirm.

Steps to Reproduce

Configure an OIDC App with a PostLogout URL (e.g. http://localhost:3000/auth/logged-out)
From the client app, redirect to: GET /oidc/session/end?id_token_hint=<token>&post_logout_redirect_uri=http://localhost:3000/auth/logged-out
VoidAuth correctly redirects to /logout/<id> (confirmation page)
Click "Yes" to confirm logout
Expected: Browser redirects to http://localhost:3000/auth/logged-out
Actual: Nothing happens visually. The page stays on the confirmation screen.

Debug Logs

With ENABLE_DEBUG: true, the server logs show:
POST /oidc/session/end/confirm → 303, location: http://localhost:3000/auth/logged-out

The backend correctly returns a 303 See Other with the Location header pointing to the post_logout_redirect_uri. However, the SPA frontend appears to handle the POST via JavaScript (AJAX/fetch) rather than a native form submission, so the browser does not follow the 303 redirect.

Clicking "Yes" a second time triggers a second POST which returns 400 Bad Request with {"error":"invalid_request","error_description":"could not find logout details"} because the session was already destroyed by the first POST.

Environment

VoidAuth: latest (Docker voidauth/voidauth:latest)
DB: SQLite
Auth Method: None (Public client, PKCE)
Browsers tested: Safari, Chrome (same behavior)
DISABLE_HTTPS: true, ALLOW_INSECURE_REDIRECTS: true

Suggested Fix

The logout confirmation page SPA should either:

Use a native <form> submission instead of a JavaScript fetch/AJAX call, so the browser natively follows the 303 redirect
Or read the Location header from the 303 response and do window.location.href = location

## Description When using RP-Initiated Logout (`/oidc/session/end`), the VoidAuth SPA logout confirmation page (`/logout/<id>`) does not follow the 303 redirect returned by `POST /oidc/session/end/confirm`. ## Steps to Reproduce 1. Configure an OIDC App with a `PostLogout URL` (e.g. `http://localhost:3000/auth/logged-out`) 2. From the client app, redirect to: `GET /oidc/session/end?id_token_hint=<token>&post_logout_redirect_uri=http://localhost:3000/auth/logged-out` 3. VoidAuth correctly redirects to `/logout/<id>` (confirmation page) 4. Click "Yes" to confirm logout 5. **Expected:** Browser redirects to `http://localhost:3000/auth/logged-out` 6. **Actual:** Nothing happens visually. The page stays on the confirmation screen. ## Debug Logs With `ENABLE_DEBUG: true`, the server logs show: POST /oidc/session/end/confirm → 303, location: http://localhost:3000/auth/logged-out The backend correctly returns a `303 See Other` with the `Location` header pointing to the `post_logout_redirect_uri`. However, the SPA frontend appears to handle the POST via JavaScript (AJAX/fetch) rather than a native form submission, so the browser does not follow the 303 redirect. Clicking "Yes" a second time triggers a second POST which returns `400 Bad Request` with `{"error":"invalid_request","error_description":"could not find logout details"}` because the session was already destroyed by the first POST. ## Environment - VoidAuth: latest (Docker `voidauth/voidauth:latest`) - DB: SQLite - Auth Method: None (Public client, PKCE) - Browsers tested: Safari, Chrome (same behavior) - `DISABLE_HTTPS: true`, `ALLOW_INSECURE_REDIRECTS: true` ## Suggested Fix The logout confirmation page SPA should either: - Use a native `<form>` submission instead of a JavaScript fetch/AJAX call, so the browser natively follows the 303 redirect - Or read the `Location` header from the 303 response and do `window.location.href = location`

notquitenothing commented

2026-05-15 17:24:27 -05:00

(Migrated from github.com)

I am not able to replicate this bug in my development environment. When I use the RP-Initiated Logout path http://auth.nqn.localhost/voidauth/oidc/session/end?client_id=debugger&post_logout_redirect_uri=http://whoami.nqn.localhost/postlogout the resulting 303 redirect is followed correctly to http://whoami.nqn.localhost/postlogout after logout is complete

I am not able to replicate this bug in my development environment. When I use the RP-Initiated Logout path `http://auth.nqn.localhost/voidauth/oidc/session/end?client_id=debugger&post_logout_redirect_uri=http://whoami.nqn.localhost/postlogout` the resulting `303` redirect is followed correctly to `http://whoami.nqn.localhost/postlogout` after logout is complete