mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-09 20:26:33 +00:00
kevinveenbirkenbachandClaude Opus 5
75047ef459
The injected logout built `?redirect_uri=<web_protocol>://<DOMAIN_PRIMARY>` and appended it to the end-session endpoint. Keycloak 26.7.1 (roles/web-app-keycloak/meta/services.yml:49-50) does not accept redirect_uri there - it takes post_logout_redirect_uri plus id_token_hint or client_id - so the parameter was dropped on arrival. Run 32284541284 job 96178507650 shows the proof: Keycloak answered with its logout-confirm interstitial carrying client_id=account, i.e. it resolved no client from the request at all. The value was wrong as well as inert. DOMAIN_PRIMARY is claimed only by roles/svc-prx-openresty, which declares no sso block, so it is never a registered redirect URI - the parameter would have been rejected on clearnet too the moment it became effective. Under tor it also glued the app's own scheme to the portal's host. Removing rather than correcting is what keeps this safe: every way this could break requires a redirect target to be validated, and after the diff there is no target. The emitted request is a strict prefix of today's. The same three lines were duplicated verbatim in four web-app roles; they collapse to the bare endpoint the shared role already passed. The caller graph is closed - initLogoutPatch appears exactly three times (definition, export, call site) - so the arity change leaves no orphan. Fixes nothing that was failing; no CI job was red because of this. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
7 lines
164 B
Django/Jinja
7 lines
164 B
Django/Jinja
document.addEventListener('DOMContentLoaded', function() {
|
|
initLogoutPatch(
|
|
'{{ OIDC.CLIENT.LOGOUT_URL }}',
|
|
{{ MODE_DEBUG | lower }}
|
|
);
|
|
});
|