Firewall Authorization Not Revoked Immediately After OIDC Logout

[krage3x]

Note: Please take the following with a grain of salt—I was investigating this quickly and may have missed some details. I’m happy to clarify or provide more information if needed.

Question

Would you please clarify if the desired logic is to wait until the session expiration time for revoking firewall authorization, or should access be revoked immediately upon logout? Currently, the firewall shows "authorized": true until the session timeout, even after a successful logout. Should the firewall be updated in real-time when a device session is ended, or is relying on the timeout the intended behavior?

Description

After performing an OIDC logout (POST /api/logout → 204 OK), the firewall still shows "authorized": true for the user until the session timeout (MaxSessionLifetimeMinutes: 2), instead of being revoked instantly.

Reproduction Steps

• OIDC login → ./wag firewall -list → "authorized": true, "expiry": "16:44:08"
• Click logout → 204 OK, but firewall still shows "authorized": true
• After ~2 minutes (timeout), "authorized" becomes false

Debugging

• Traced logout call: Vue api/logout.ts → Go internal/mfaportal/portal.go → user.Deauthenticate(clientTunnelIp)
• Found in internal/database/devices.go → DeauthenticateDevice():
  • PUT etcd key {Authorised: time.Time{}}
  • DELETE etcd key (function MarkDeviceSessionEnded)
• However, internal/firewall/firewall.go handleEvents() only watches data.InactivityTimeoutKey (config), missing a watcher for DeviceSessionPrefix changes.

Config:

"MaxSessionLifetimeMinutes": 2,
"SessionInactivityTimeoutMinutes": 1

[NHAS]

This is a little bit complicated to explain.

You are correct that the router/firewall within wag doesnt watch the devices session etcd key. However that isnt actually the way that a device is logged out/deauthorized.

That is done by setting the devices Authorised time field to the zero value of time.Time{}.
Which then causes the state machine to deauthorise the device if it was authorized:

wag/internal/router/statemachine.go

Line 110 in d1904a0

current.Authorised.IsZero() { // If we've explicitly deauthorised a device

The MarkDeviceSessionEnded function deletes an etcd key so that the event based nature of etcd will flow that down to the frontend. The key that it manages is actually deleted in 3 different ways, which I can understand is a little opaque:

1. The logout function after where the Authorised field is set as time.Time{}
2. Within the router/firewall itself, when a session has become inactive a timer is fired to run just that function, as the device is now automatically unauthed
3. When the time to live on the etcd key expires

There is no watching of the key to capture case number 3. as the TTL (time to live) on the etcd key is the same as the max session life time that is initialised within the wag device:

wag/internal/router/statemachine.go

Line 142 in d1904a0

err := f.SetAuthorized(current.Address, current.AssociatedNode)

wag/internal/router/firewall.go

Line 286 in d1904a0

device.sessionExpiry = time.Now().Add(time.Duration(timeToSet) * time.Minute)

In short, as you're using an OIDC provider, are you sure it didnt automatically relog you in, there was another discussion you commented on where someone was talking about that.

P.S I think for clarities sake, having a watcher in the router for the session key to delete it router side is a good idea

[krage3x]

Really appreciate the thorough answer!
Just when I replied in the other thread, I thought about this, and I think that’s exactly what’s happening — the OIDC provider is automatically relogging me in. I see it makes the logout call, but right after, it immediately redirects you to "/" ending up being reauthenticated.