From b2af3a7f62c59c81306c60ad563b4390f0eedf8a Mon Sep 17 00:00:00 2001
From: Kristoffer Brabrand <kristoffer@brabrand.no>
Date: Fri, 2 Sep 2022 13:16:43 +0200
Subject: [PATCH] Include redirectUrl even if idTokenHint is not provided to
 Keycloak.prototype.logoutUrl. Fixes #420

---
 keycloak.js                       |  5 ++++-
 test/unit/keycloak-object-test.js | 18 ++++++++++++++++++
 2 files changed, 22 insertions(+), 1 deletion(-)

diff --git a/keycloak.js b/keycloak.js
index 101233f9..185854a5 100644
--- a/keycloak.js
+++ b/keycloak.js
@@ -403,8 +403,11 @@ Keycloak.prototype.loginUrl = function (uuid, redirectUrl) {
 Keycloak.prototype.logoutUrl = function (redirectUrl, idTokenHint) {
   const url = new URL(this.config.realmUrl + '/protocol/openid-connect/logout')
 
-  if (redirectUrl && idTokenHint) {
+  if (idTokenHint) {
     url.searchParams.set('id_token_hint', idTokenHint)
+  }
+
+  if (redirectUrl) {
     url.searchParams.set('post_logout_redirect_uri', redirectUrl)
   }
 
diff --git a/test/unit/keycloak-object-test.js b/test/unit/keycloak-object-test.js
index eb5b3cc2..2d8341b5 100644
--- a/test/unit/keycloak-object-test.js
+++ b/test/unit/keycloak-object-test.js
@@ -70,6 +70,24 @@ test('Should verify if logout URL has the configured realm.', t => {
   t.end()
 })
 
+test('Should verify if logout URL includes passed redirect url if provided.', t => {
+  const redirectUrl = 'https://secure.foo.bar'
+  const redirectRgx = new RegExp(`post_logout_redirect_uri=${encodeURIComponent('https://secure.foo.bar')}`)
+
+  t.equal(kc.logoutUrl(redirectUrl).match(redirectRgx) !== null, true)
+  t.end()
+})
+
+test('Should verify if logout URL includes passed redirect url + id token hint if provided.', t => {
+  const idToken = 'abc123'
+  const redirectUrl = 'https://secure.foo.bar'
+  const redirectRgx = new RegExp(`post_logout_redirect_uri=${encodeURIComponent('https://secure.foo.bar')}`)
+
+  t.equal(kc.logoutUrl(redirectUrl, idToken).match(redirectRgx) !== null, true)
+  t.equal(kc.logoutUrl(redirectUrl, idToken).indexOf(idToken) > 0, true)
+  t.end()
+})
+
 test('Should generate a correct UUID.', t => {
   const rgx = /^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$/
   t.equal(rgx.test(UUID()), true)