@@ -168,23 +168,23 @@ function initWebId (argv, app, ldp) {
168
168
// (for same-domain browsing by people only)
169
169
const useSecureCookies = ! ! argv . sslKey // use secure cookies when over HTTPS
170
170
const sessionHandler = session ( sessionSettings ( useSecureCookies , argv . host ) )
171
+ app . use ( sessionHandler )
172
+ // Reject cookies from third-party applications.
173
+ // Otherwise, when a user is logged in to their Solid server,
174
+ // any third-party application could perform authenticated requests
175
+ // without permission by including the credentials set by the Solid server.
171
176
app . use ( ( req , res , next ) => {
172
- sessionHandler ( req , res , ( ) => {
173
- // Reject cookies from third-party applications.
174
- // Otherwise, when a user is logged in to their Solid server,
175
- // any third-party application could perform authenticated requests
176
- // without permission by including the credentials set by the Solid server.
177
- const origin = req . headers . origin
178
- const userId = req . session . userId
179
- if ( ! argv . host . allowsSessionFor ( userId , origin ) ) {
180
- debug ( `Rejecting session for ${ userId } from ${ origin } ` )
181
- // Destroy session data
182
- delete req . session . userId
183
- // Ensure this modified session is not saved
184
- req . session . save = ( done ) => done ( )
185
- }
186
- next ( )
187
- } )
177
+ const origin = req . headers . origin
178
+ const userId = req . session . userId
179
+ // Exception: allow logout requests from all third-party apps
180
+ if ( ! argv . host . allowsSessionFor ( userId , origin ) && ! isLogoutRequest ( req ) ) {
181
+ debug ( `Rejecting session for ${ userId } from ${ origin } ` )
182
+ // Destroy session data
183
+ delete req . session . userId
184
+ // Ensure this modified session is not saved
185
+ req . session . save = ( done ) => done ( )
186
+ }
187
+ next ( )
188
188
} )
189
189
190
190
let accountManager = AccountManager . from ( {
@@ -209,6 +209,15 @@ function initWebId (argv, app, ldp) {
209
209
}
210
210
}
211
211
212
+ /**
213
+ * Determines whether the given request is a logout request
214
+ */
215
+ function isLogoutRequest ( req ) {
216
+ // TODO: this is a hack that hard-codes OIDC paths,
217
+ // this code should live in the OIDC module
218
+ return req . path === '/logout' || req . path === '/goodbye'
219
+ }
220
+
212
221
/**
213
222
* Sets up authentication-related routes and handlers for the app.
214
223
*
0 commit comments