remove session_state claim condition for end provide session

travisghansen · Oct 4, 2023 · 8ad0d71 · 8ad0d71
1 parent b490c79
commit 8ad0d71
Showing 1 changed file with 24 additions and 25 deletions.
diff --git a/src/plugin/oauth/index.js b/src/plugin/oauth/index.js
@@ -1511,33 +1511,32 @@ class BaseOauthPlugin extends BasePlugin {
           sessionPayload.tokenSet.id_token
         ) {
           let idToken = jwt.decode(sessionPayload.tokenSet.id_token);
-          // TODO: this check may not be entirely needed/wanted
-          if (idToken.session_state) {
-            const payload = {
-              redirect_uri: redirect_uri,
-              aud: configAudMD5,
-              req: {
-                headers: {
-                  referer: req.headers.referer,
-                },
+
+          const payload = {
+            redirect_uri: redirect_uri,
+            aud: configAudMD5,
+            req: {
+              headers: {
+                referer: req.headers.referer,
               },
-              request_is_xhr,
-            };
-            const stateToken = jwt.sign(payload, issuer_sign_secret);
-            const state = plugin.server.utils.encrypt(
-              issuer_encrypt_secret,
-              stateToken,
-              "hex"
-            );
+            },
+            request_is_xhr,
+          };
+          const stateToken = jwt.sign(payload, issuer_sign_secret);
+          const state = plugin.server.utils.encrypt(
+            issuer_encrypt_secret,
+            stateToken,
+            "hex"
+          );
 
-            redirect_uri = await client.endSessionUrl({
-              id_token_hint: sessionPayload.tokenSet.id_token,
-              post_logout_redirect_uri:
-                plugin.config.features.logout.end_provider_session
-                  .post_logout_redirect_uri,
-              state,
-            });
-          }
+          redirect_uri = await client.endSessionUrl({
+            id_token_hint: sessionPayload.tokenSet.id_token,
+            post_logout_redirect_uri:
+              plugin.config.features.logout.end_provider_session
+                .post_logout_redirect_uri,
+            state,
+          });
+
         }
 
         plugin.server.logger.info("deleting session: %s", session_id);