-
Notifications
You must be signed in to change notification settings - Fork 2.1k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
fix(auth): Do not sign out client if Oauth signout fails (#12520)
* fix(auth): Do not sign out client if Oauth signout fails * Do not block local data/tokens clearing for private sessions * Update to perform slightly different OAuth handling on web vs native --------- Co-authored-by: Jim Blanchard <[email protected]>
- Loading branch information
Showing
7 changed files
with
138 additions
and
76 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
14 changes: 14 additions & 0 deletions
14
packages/auth/src/providers/cognito/utils/oauth/completeOAuthSignOut.ts
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,14 @@ | ||
| // Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. | ||
| // SPDX-License-Identifier: Apache-2.0 | ||
|
|
||
| import { clearCredentials, Hub } from '@aws-amplify/core'; | ||
| import { AMPLIFY_SYMBOL } from '@aws-amplify/core/internals/utils'; | ||
| import { DefaultOAuthStore } from '../../utils/signInWithRedirectStore'; | ||
| import { tokenOrchestrator } from '../../tokenProvider'; | ||
|
|
||
| export const completeOAuthSignOut = async (store: DefaultOAuthStore) => { | ||
| await store.clearOAuthData(); | ||
| tokenOrchestrator.clearTokens(); | ||
| await clearCredentials(); | ||
| Hub.dispatch('auth', { event: 'signedOut' }, 'Auth', AMPLIFY_SYMBOL); | ||
| }; |
32 changes: 32 additions & 0 deletions
32
packages/auth/src/providers/cognito/utils/oauth/handleOAuthSignOut.native.ts
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,32 @@ | ||
| // Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. | ||
| // SPDX-License-Identifier: Apache-2.0 | ||
|
|
||
| import { CognitoUserPoolConfig } from '@aws-amplify/core'; | ||
| import { OpenAuthSessionResult } from '../../../../utils/types'; | ||
| import { DefaultOAuthStore } from '../../utils/signInWithRedirectStore'; | ||
| import { completeOAuthSignOut } from './completeOAuthSignOut'; | ||
| import { oAuthSignOutRedirect } from './oAuthSignOutRedirect'; | ||
|
|
||
| export const handleOAuthSignOut = async ( | ||
| cognitoConfig: CognitoUserPoolConfig, | ||
| store: DefaultOAuthStore | ||
| ): Promise<void | OpenAuthSessionResult> => { | ||
| const { isOAuthSignIn, preferPrivateSession } = await store.loadOAuthSignIn(); | ||
|
|
||
| if (isOAuthSignIn) { | ||
| const result = await oAuthSignOutRedirect( | ||
| cognitoConfig, | ||
| preferPrivateSession | ||
| ); | ||
| // If this was a private session, clear data and tokens regardless of what happened with logout | ||
| // endpoint. Otherwise, only do so if the logout endpoint was succesfully visited. | ||
| const shouldCompleteSignOut = | ||
| preferPrivateSession || result?.type === 'success'; | ||
| if (shouldCompleteSignOut) { | ||
| await completeOAuthSignOut(store); | ||
| } | ||
| return result; | ||
| } | ||
|
|
||
| return completeOAuthSignOut(store); | ||
| }; |
24 changes: 24 additions & 0 deletions
24
packages/auth/src/providers/cognito/utils/oauth/handleOAuthSignOut.ts
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,24 @@ | ||
| // Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. | ||
| // SPDX-License-Identifier: Apache-2.0 | ||
|
|
||
| import { CognitoUserPoolConfig } from '@aws-amplify/core'; | ||
| import { OpenAuthSessionResult } from '../../../../utils/types'; | ||
| import { DefaultOAuthStore } from '../../utils/signInWithRedirectStore'; | ||
| import { completeOAuthSignOut } from './completeOAuthSignOut'; | ||
| import { oAuthSignOutRedirect } from './oAuthSignOutRedirect'; | ||
|
|
||
| export const handleOAuthSignOut = async ( | ||
| cognitoConfig: CognitoUserPoolConfig, | ||
| store: DefaultOAuthStore | ||
| ): Promise<void | OpenAuthSessionResult> => { | ||
| const { isOAuthSignIn } = await store.loadOAuthSignIn(); | ||
|
|
||
| // Clear everything before attempting to visted logout endpoint since the current application | ||
| // state could be wiped away on redirect | ||
| await completeOAuthSignOut(store); | ||
|
|
||
| if (isOAuthSignIn) { | ||
| // On web, this will always end up being a void action | ||
| return oAuthSignOutRedirect(cognitoConfig); | ||
| } | ||
| }; |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
30 changes: 30 additions & 0 deletions
30
packages/auth/src/providers/cognito/utils/oauth/oAuthSignOutRedirect.ts
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,30 @@ | ||
| // Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. | ||
| // SPDX-License-Identifier: Apache-2.0 | ||
|
|
||
| import { CognitoUserPoolConfig } from '@aws-amplify/core'; | ||
| import { assertOAuthConfig } from '@aws-amplify/core/internals/utils'; | ||
| import { openAuthSession } from '../../../../utils'; | ||
| import { OpenAuthSessionResult } from '../../../../utils/types'; | ||
| import { getRedirectUrl } from './getRedirectUrl'; | ||
|
|
||
| export const oAuthSignOutRedirect = async ( | ||
| authConfig: CognitoUserPoolConfig, | ||
| preferPrivateSession: boolean = false | ||
| ): Promise<void | OpenAuthSessionResult> => { | ||
| assertOAuthConfig(authConfig); | ||
| const { loginWith, userPoolClientId } = authConfig; | ||
| const { domain, redirectSignOut } = loginWith.oauth; | ||
| const signoutUri = getRedirectUrl(redirectSignOut); | ||
| const oAuthLogoutEndpoint = `https://${domain}/logout?${Object.entries({ | ||
| client_id: userPoolClientId, | ||
| logout_uri: encodeURIComponent(signoutUri), | ||
| }) | ||
| .map(([k, v]) => `${k}=${v}`) | ||
| .join('&')}`; | ||
|
|
||
| return openAuthSession( | ||
| oAuthLogoutEndpoint, | ||
| redirectSignOut, | ||
| preferPrivateSession | ||
| ); | ||
| }; |