diff --git a/src/lib/oauth2-service.ts b/src/lib/oauth2-service.ts index 5020d62..cef0b51 100644 --- a/src/lib/oauth2-service.ts +++ b/src/lib/oauth2-service.ts @@ -378,14 +378,16 @@ export class OAuth2Service extends EventEmitter { }; private endSessionHandler: RequestHandler = (req, res) => { - assertIsString( - req.query['post_logout_redirect_uri'], - 'Invalid post_logout_redirect_uri type', - ); - - const postLogoutRedirectUri: MutableRedirectUri = { - url: new URL(req.query['post_logout_redirect_uri']), - }; + let postLogoutRedirectUri: MutableRedirectUri | undefined = undefined; + if (req.query['post_logout_redirect_uri']) { + assertIsString( + req.query['post_logout_redirect_uri'], + 'Invalid post_logout_redirect_uri type', + ); + postLogoutRedirectUri = { + url: new URL(req.query['post_logout_redirect_uri']), + }; + } /** * Before post logout redirect event. @@ -395,7 +397,11 @@ export class OAuth2Service extends EventEmitter { */ this.emit(Events.BeforePostLogoutRedirect, postLogoutRedirectUri, req); - return res.redirect(postLogoutRedirectUri.url.href); + if (postLogoutRedirectUri !== undefined) { + return res.redirect(postLogoutRedirectUri.url.href); + } else { + return res.status(200).send('Logout successful'); + } }; private introspectHandler: RequestHandler = (req, res) => { diff --git a/test/oauth2-service.test.ts b/test/oauth2-service.test.ts index 2f3cf9d..d3e8156 100644 --- a/test/oauth2-service.test.ts +++ b/test/oauth2-service.test.ts @@ -756,6 +756,15 @@ describe('OAuth 2 service', () => { expect(res.headers.location).toBe(postLogoutRedirectUri); }); + it('should show a page with the text "Logout successful" if no post_logout_redirect_uri was passed to the end_session_endpoint', async () => { + const res = await request(service.requestHandler) + .get('/endsession') + .redirects(0) + .expect(200); + + expect(res.text).toBe("Logout successful"); + }); + it('should be able to manipulate url and query params when redirecting within post_logout_redirect_uri', async () => { const postLogoutRedirectUri = 'http://example.com/signin?param=test';