[BUG] Regression in Auth0 logout

[Badisi]

Is there an existing issue for this?

• I have searched the existing issues

Library version

latest

Description

The following patch is taking care of adding an end_session_endpoint for Auth0 so that logout can work:

auth-js/projects/auth-js/oidc/oidc-auth-manager.ts

Lines 472 to 490 in e81f20a

	/**
	* Auth0 does not conform to OIDC's logout session and as such does not provide an `end_session_endpoint`.
	* This patch make sure the `end_session_endpoint` is set in that case.
	* @see https://github.com/damienbod/angular-auth-oidc-client/issues/1197
	* @see https://auth0.com/docs/api/authentication#logout
	*/
	private patchAuth0Logout(): void {
	if (this.settings.authorityUrl.endsWith('auth0.com')) {
	const { authorityUrl, clientId, desktopNavigationType } = this.settings;
	const returnTo = (desktopNavigationType === DesktopNavigation.POPUP) ?
	this.settings.internal?.popup_post_logout_redirect_uri :
	this.settings.internal?.post_logout_redirect_uri;
	this.settings.internal = merge({}, {
	metadataSeed: {
	end_session_endpoint: `${authorityUrl}/v2/logout?client_id=${clientId}&returnTo=${returnTo}`
	}
	}, this.settings.internal);
	}
	}

The following PR in oidc-client-ts introduced the add of client_id to logout requests:
authts/oidc-client-ts#1038

Results is a duplicate of client_id in the url and a crash of Auth0 "Oops something went wrong".

So client_id can be safely removed from the patch.

[Badisi]

Actually the whole patch can be removed as Auth0 now provides a support for end session.

https://auth0.com/docs/authenticate/login/logout/log-users-out-of-auth0

For Auth0 tenants created on or after 14 November 2023, RP-Initiated Logout End Session Endpoint Discovery is enabled by default.

You can enable RP-Initiated Logout End Session Endpoint Discovery in the Auth0 Dashboard or with the Auth0 Management API.

[Badisi]

🎉 Released in @badisi/[email protected] 📦🚀

[Badisi]

🎉 Released in @badisi/[email protected] 📦🚀