Skip to content

adding id_token_hint on Logout

While testing Keycloak v18 I saw that this release altered the logout function to be more 'compatible' with the specification "OpenID Connect Logout".

https://www.keycloak.org/docs/latest/upgrading/index.html#openid-connect-logout

The simple 'fix' to get the logout working again is adding the user id token in a id_token_hint.

I've tested a fix on session-middlewares.js, if I backport it on session-middlewares.ts it would look like this (but this is not my primary language, you may find better ways):

--- a/src/usecase/session-middlewares.ts
+++ b/src/usecase/session-middlewares.ts
@@ -396,9 +396,12 @@ export class SessionMgmt {
       next: NextFunction
     ): Promise<void> => {
       const token = this.getAccessToken(req);
+      const oidcClient = yield this.oidcClientGetter(req);
+      const details = yield this.getSessionDetails(oidcClient, token, true);
+      const id_token_hint = details.tokens.id_token;
       await this.clearSessionCache(token);
       try {
-        res.redirect((await this.oidcClientGetter(req)).endSessionUrl());
+        res.redirect((await this.oidcClientGetter(req)).endSessionUrl({"id_token_hint":id_token_hint}));
       } catch (error) {
         return this.getPostLogoutMw()(req,res,next);
       }