/logout should not be a GET request

[RubenVerborgh]

Since /logout changes state, it should not be GET.

[RubenVerborgh]

We can already implement a parallel route with POST for 4.1, and then drop the GET route for 5.0 (semver.major).

[dmitrizagidulin]

Heh, so this is the issue that was being addressed in the closed issue #675. (Though I totally get that 675 was named in an overly-specific nondescript manner).

So here's the story. Server-side support for this has been implemented in nodeSolidServer/oidc-op#7 (though that PR still needs some tests, that's been the main holdup). Once that's merged, it'll need to be integrated into node-solid-server.

On the client-side, this has been implemented in PR nodeSolidServer/oidc-rp#5. That changes how an auth client needs to use the logout call, etc.

[RubenVerborgh]

Heh, so this is the issue that was being addressed in the closed issue #675.

#675 about the post-logout redirection URL, right?

#744 is about using HTTP POST to log out instead of GET.

[dmitrizagidulin]

Yeah, so that's what I mean that it was badly named :)
#675 is about fixing the POST handling of the /logout endpoint (and removing the existing GET /logout route in webid-oidc.js). And the thing that was blocking /that/ was post-logout redirect handling.

Anyways, I figured I'd give an overview of where the story stands right now.

[RubenVerborgh]

Makes sense, thanks.

[dmitrizagidulin]

Ah, wait, though. Now I remember. So there's a couple of reasons why the /logout endpoint might still need to be a GET.

One, it may be useful to retain the ability for a user to just visit their pod's /logout endpoint via just typing it in to the url bar.

I suppose we can just require them to press a Logout button somewhere (which submits a form POST). When the user presses the logout button, a couple things need to happen. They need to be prompted with a choice screen asking if they also want to log out of the pod (in addition to logging out of the RP app). Their browser cookies (which are http only, not JS) need to be cleared. And then they need to be redirected to the post_logout_redirect_uri.

So, basically, one of the ways to get around the fact that logging out changes state, is that a GET to /logout just gets you a confirmation screen (idempotent). Which then POSTS to the /logout endpoint if the user confirms.

[RubenVerborgh]

Indeed. As long as the GET (or any GET, for that matter) doesn't trigger a state change, it's fine.

[RubenVerborgh]

Unfortunately, I see lots of OIDC examples where logout is a GET request, so maybe this is just how it's done.

The OIDC spec itself does not mention anything though: http://openid.net/specs/openid-connect-session-1_0.html#RPLogout

[kidehen]

@RubenVerborgh ,

As already stated, GET is appropriate if the request is idempotent (isn't state changing). Otherwise it should be POST, despite under specification in the OIDC docs.

/cc @cblakeley @smalinin