adding id_token_hint on Logout
While testing Keycloak v18 I saw that this release altered the logout function to be more 'compatible' with the specification "OpenID Connect Logout".
https://www.keycloak.org/docs/latest/upgrading/index.html#openid-connect-logout
The simple 'fix' to get the logout working again is adding the user id token in a id_token_hint.
I've tested a fix on session-middlewares.js, if I backport it on session-middlewares.ts it would look like this (but this is not my primary language, you may find better ways):
--- a/src/usecase/session-middlewares.ts
+++ b/src/usecase/session-middlewares.ts
@@ -396,9 +396,12 @@ export class SessionMgmt {
next: NextFunction
): Promise<void> => {
const token = this.getAccessToken(req);
+ const oidcClient = yield this.oidcClientGetter(req);
+ const details = yield this.getSessionDetails(oidcClient, token, true);
+ const id_token_hint = details.tokens.id_token;
await this.clearSessionCache(token);
try {
- res.redirect((await this.oidcClientGetter(req)).endSessionUrl());
+ res.redirect((await this.oidcClientGetter(req)).endSessionUrl({"id_token_hint":id_token_hint}));
} catch (error) {
return this.getPostLogoutMw()(req,res,next);
}