Remove the session cookie if ID token verification failed

(cherry picked from commit 298b008)
quarkusio · Mar 25, 2023 · abdbc29 · abdbc29
1 parent a1ee660
commit abdbc29
Show file tree

Hide file tree

Showing 2 changed files with 23 additions and 2 deletions.
diff --git a/...sions/oidc/runtime/src/main/java/io/quarkus/oidc/runtime/CodeAuthenticationMechanism.java b/...sions/oidc/runtime/src/main/java/io/quarkus/oidc/runtime/CodeAuthenticationMechanism.java
@@ -287,8 +287,13 @@ public Uni<? extends SecurityIdentity> apply(Throwable t) {
 
                                             if (!expired) {
                                                 LOG.errorf("ID token verification failure: %s", t.getCause());
-                                                return Uni.createFrom()
-                                                        .failure(new AuthenticationCompletionException(t.getCause()));
+                                                return removeSessionCookie(context, configContext.oidcConfig)
+                                                        .replaceWith(Uni.createFrom()
+                                                                .failure(t
+                                                                        .getCause() instanceof AuthenticationCompletionException
+                                                                                ? t.getCause()
+                                                                                : new AuthenticationCompletionException(
+                                                                                        t.getCause())));
                                             }
                                             // Token has expired, try to refresh
                                             if (session.getRefreshToken() == null) {

diff --git a/integration-tests/oidc-code-flow/src/test/java/io/quarkus/it/keycloak/CodeFlowTest.java b/integration-tests/oidc-code-flow/src/test/java/io/quarkus/it/keycloak/CodeFlowTest.java
@@ -564,6 +564,22 @@ public void testIdTokenInjection() throws IOException {
             page = webClient.getPage("http://localhost:8081/web-app");
 
             assertEquals("alice", page.getBody().asNormalizedText());
+
+            Cookie sessionCookie = getSessionCookie(webClient, null);
+            assertNotNull(sessionCookie);
+            webClient.getCookieManager().clearCookies();
+            webClient.getCookieManager().addCookie(new Cookie(sessionCookie.getDomain(), sessionCookie.getName(),
+                    "1|2|3"));
+            sessionCookie = getSessionCookie(webClient, null);
+            assertEquals("1|2|3", sessionCookie.getValue());
+
+            try {
+                webClient.getPage("http://localhost:8081/web-app");
+                fail("401 status error is expected");
+            } catch (FailingHttpStatusCodeException ex) {
+                assertEquals(401, ex.getStatusCode());
+                assertNull(getSessionCookie(webClient, null));
+            }
             webClient.getCookieManager().clearCookies();
         }
     }