How do I logout when using Spring WebFlux and OAuth 2.0 Login? - spring-boot

Question

I have the following LogoutResource that works well with Spring Boot 2.2 using Spring MVC:
#RestController
public class LogoutResource {
private ClientRegistration registration;
public LogoutResource(ClientRegistrationRepository registrations) {
this.registration = registrations.findByRegistrationId("oidc");
}
/**
* {#code POST /api/logout} : logout the current user.
*
* #param request the {#link HttpServletRequest}.
* #param idToken the ID token.
* #return the {#link ResponseEntity} with status {#code 200 (OK)} and a body with a global logout URL and ID token.
*/
#PostMapping("/api/logout")
public ResponseEntity<?> logout(HttpServletRequest request,
#AuthenticationPrincipal(expression = "idToken") OidcIdToken idToken) {
String logoutUrl = this.registration.getProviderDetails()
.getConfigurationMetadata().get("end_session_endpoint").toString();
Map<String, String> logoutDetails = new HashMap<>();
logoutDetails.put("logoutUrl", logoutUrl);
logoutDetails.put("idToken", idToken.getTokenValue());
request.getSession().invalidate();
return ResponseEntity.ok().body(logoutDetails);
}
}
The Angular client takes this response and redirects to Keycloak to log the user out. This all works great.
logout(): void {
this.authServerProvider.logout().subscribe((logout: Logout) => {
let logoutUrl = logout.logoutUrl;
const redirectUri = `${location.origin}${this.location.prepareExternalUrl('/')}`;
// if Keycloak, uri has protocol/openid-connect/token
if (logoutUrl.includes('/protocol')) {
logoutUrl = logoutUrl + '?redirect_uri=' + redirectUri;
} else {
// Okta
logoutUrl = logoutUrl + '?id_token_hint=' + logout.idToken + '&post_logout_redirect_uri=' + redirectUri;
}
window.location.href = logoutUrl;
});
}
Now I'm trying to change it so it works with Spring WebFlux. The following seems to work and returns the expected response (I've verified this by printing the values in my Angular logout() method).
#RestController
public class LogoutResource {
private Mono<ClientRegistration> registration;
public LogoutResource(ReactiveClientRegistrationRepository registrations) {
this.registration = registrations.findByRegistrationId("oidc");
}
/**
* {#code POST /api/logout} : logout the current user.
*
* #param idToken the ID token.
* #return the {#link ResponseEntity} with status {#code 200 (OK)} and a body with a global logout URL and ID token.
*/
#PostMapping("/api/logout")
public Mono<Map<String, String>> logout(#AuthenticationPrincipal(expression = "idToken") OidcIdToken idToken) {
return this.registration.map(oidc ->
oidc.getProviderDetails().getConfigurationMetadata().get("end_session_endpoint").toString())
.map(logoutUrl -> {
Map<String, String> logoutDetails = new HashMap<>();
logoutDetails.put("logoutUrl", logoutUrl);
logoutDetails.put("idToken", idToken.getTokenValue());
SecurityContextHolder.clearContext();
return logoutDetails;
});
}
}
You might notice I tried using SecurityContextHolder.clearContext() instead of request.getSession().invalidate(). This doesn't seem to work because the user is still logged in. Any idea what I need to do to kill the user's security session with WebFlux?

Answer 1

I was able to fix this by injecting a WebSession and calling invalidate() on it.
#PostMapping("/api/logout")
public Mono<Map<String, String>> logout(#AuthenticationPrincipal(expression = "idToken") OidcIdToken idToken, WebSession session) {
return session.invalidate().then(
this.registration.map(oidc -> oidc.getProviderDetails().getConfigurationMetadata().get("end_session_endpoint").toString())
.map(logoutUrl -> {
Map<String, String> logoutDetails = new HashMap<>();
logoutDetails.put("logoutUrl", logoutUrl);
logoutDetails.put("idToken", idToken.getTokenValue());
return logoutDetails;
})
);
}