Missing logout_challenge query parameter on logout redirect

[barsaboowo]

For request 'GET /hydra/logout?state=somelongvalue' [Missing parameter: logout_challenge]

Hydra version: 1.0.9
Environment: docker using image tagged "latest"
Config:
name: OIDC_SUBJECT_IDENTIFIERS_ENABLED
value: public

• name: OAUTH2_ACCESS_TOKEN_STRATEGY
  value: jwt
• name: URLS_SELF_ISSUER
  value: https://xxxxx
• name: URLS_CONSENT
  value: https://xxx/hydra/consent
• name: URLS_LOGIN
  value: https://xxxx/hydra/login
• name: URLS_LOGOUT
  value: https:/xxxx/hydra/logout
• name: DSN
  value: memory
• name: SECRETS_SYSTEM
  value: xxxxx
• name: OIDC_SUBJECT_TYPES_SUPPORTED
  value: public,pairwise
• name: OIDC_SUBJECT_TYPE_PAIRWISE_SALT
  value: xxxxx

Client setup:
hydra.exe clients create --skip-tls-verify --endpoint https:/xxxx:xxx --id "auth-id" -r token,id_token,code,"token id_token" -g implicit -a xxxx --callbacks https://www.getpostman.com/oauth2/callback,https://xxxxx/hydra/logout -a openid,offline --post-logout-callbacks https://xxxxx/hydra/logout

Request:
https://xxxx/oauth2/sessions/logout?post_logout_redirect_uri=https://xxxxx/hydra/logout&state=somelongvalue&id_token_hint=theidtoken

Logs:
time="2019-11-11T10:57:15Z" level=info msg="completed handling request" measure#hydra/public: https://xxxxx/.latency=856337 method=GET remote="xxxxx" request="/oauth2/sessions/logout?post_logout_redirect_uri=https://xxxxx/hydra/logout&state=somelongvalue&id_token_hint=theidtoken status=302 text_status=Found took="856.337µs"

[aeneasr]

Seems like you're hitting something similar to: #1634

While it's ok to obfuscate things (like the ID token or the hosts) that makes it insanely difficult to debug.

[barsaboowo]

Apologies. Token pasted below. In this case I was expecting a logout_challenge parameter to be sent as per https://www.ory.sh/docs/next/hydra/implementing-consent#logout

However it is not sent to the redirect specified in the config. the redirect actually has the state and the id_token_hit query parameters.

Whereas I can extract the id from the id_token_hint (which is the id token of the openid connect spec), I thought I would be able to get the logout_challenge and use it via the admin api to retrieve the logout request details:

AdminApi.getLogoutRequest(logout_challenge).

Here is the token
eyJhbGciOiJSUzI1NiIsImtpZCI6InB1YmxpYzpkMTFlZGJiYS05YjEwLTRkYjQtOGQ3Mi00OWY3OWRkNmU1YjAiLCJ0eXAiOiJKV1QifQ.eyJhdF9oYXNoIjoiV1hhbUlYNUZrYkQzM1ppVnlVTlE1ZyIsImF1ZCI6WyJuaWtlLWF1dGgtaWQiXSwiYXV0aF90aW1lIjoxNTczNDY5NzQ0LCJleHAiOjE1NzM0NzMzNDUsImlhdCI6MTU3MzQ2OTc0NSwiaXNzIjoiaHR0cHM6Ly8xMC40Ny40LjE1MTozMDA1Ny8iLCJqdGkiOiI3ZmZjOGU0NS1iNjMxLTQ4ZmEtYWJlYS1iZWRhZGY5MDRjN2UiLCJub25jZSI6ImFub25jZXRoYXRpc3F1aXRlbG9uZyIsInJhdCI6MTU3MzQ2OTcyNywic2lkIjoiOTA5ZDg5YTYtYmQ4Yi00OTAzLWE3YjQtMjIxZDFiODk1YzRmIiwic3ViIjoiUzc1Ml9UUl9UUkRfMTcifQ.ePLuc8VUO36sjqqQkzVE4LEFfE9TpNjeBEp0A-eFD9kp39CxLD0DPSSz05z3pjndP8o-KY__FhGjytFMBqbH-W3498QOaXiDh9vjCII3Z7Xt7w9-yRuKbj5BYmqUclA_WviKdN9SBpuUhTMoRTuhr4FUDup9wYaiWdfh3ctemHEYTo9jN7kpuwcLDpmTFoGWEkkXkpGGIME7nJn6pUvMYzOpoIUEHNEgk597VK4CpIXKj3QmB_FFf4sBgds3aOgGYKqdHDl46daem7zcM6gUsl4uhDurH-63k3sJCs-HBvpNhh0_A0STb3xIfCyCAjnGZFloHDx4Zhum7cH7CmGWKjs9ijc1V_x19GrIDOFartvO4_5b7CFY4x6NgLxARSjULRCDo0G6EkX8lTSJyWPY_uulbLqWHtdreqwvt0XhR_hk-39dVF6YH_YUSkIiKwMJM992mZMujTd3oo88KO8_JACNmxOj3tBJJuqOQBAWj1bkZXw8Sf75PyfK-EShHe4li5gAV1nf9E-z74r55tvT1gz23wVumfTrM1y-F-N0sPN0_thpDiWNlAOrYK_qQmGlLQtssxPwXJUqYvqFsQOVJwieLzDdIDMBGTSy5LX2rPjU50ifCkcUNAcxWZUes5AdbPwzICW69teiejcSk0anrnPxwAzHsRcqKbVy2vxCz5U

[aeneasr]

We've hat several reports in the past regarding this functionality, it always boiled down to misconfiguration or misunderstanding how the flow works. Therefore, I've updated the docs:

• https://www.ory.sh/docs/hydra/implementing-consent#user-logout
• https://www.ory.sh/docs/hydra/debugging#logout-is-not-working-as-expected

Please read them, you will probably find the problem easily. It typically boils down to:

1. Not setting remember: true when accepting login
2. Already having executed the login
3. Using another domain (e.g. mixing up localhost and 127.0.0.1)
4. Using a browser that makes storing cookies hard (e.g. Brave)

Unless you find more concrete proof of a bug (unlikely because the symptoms definitely speak for something of the list above), this will be closed.

Please also read #1634 - it has several examples of what can go wrong.

[barsaboowo]

Thanks! I discovered that we are not setting remember to true. I will close this issue now.