Merge pull request 'Refactored to deal with cookie hell' (#82) from payments into master

Reviewed-on: #82

LiteCharms.Features/Extensions/Api.cs

@@ -42,23 +42,13 @@ public static class Api
             options.Scope.Add("profile");
             options.Scope.Add("email");
 
-            options.Events = new OpenIdConnectEvents
-            {
-                OnRedirectToIdentityProvider = context =>
-                {
-                    if (!string.IsNullOrEmpty(context.ProtocolMessage.RedirectUri) && context.ProtocolMessage.RedirectUri.StartsWith("http://", StringComparison.OrdinalIgnoreCase))
-                    {
-                        var uriBuilder = new UriBuilder(context.ProtocolMessage.RedirectUri)
-                        {
-                            Scheme = "https"
-                        };
+            options.CorrelationCookie.SecurePolicy = CookieSecurePolicy.Always;
+            options.CorrelationCookie.SameSite = SameSiteMode.None;
+            options.CorrelationCookie.HttpOnly = true;
 
-                        context.ProtocolMessage.RedirectUri = uriBuilder.Uri.ToString();
-                    }
-
-                    return Task.CompletedTask;
-                },
-            };
+            options.NonceCookie.SecurePolicy = CookieSecurePolicy.Always;
+            options.NonceCookie.SameSite = SameSiteMode.None;
+            options.NonceCookie.HttpOnly = true;
         });
 
         return services;
@@ -105,36 +95,20 @@ public static class Api
         {
             await context.ChallengeAsync(OpenIdConnectDefaults.AuthenticationScheme, new AuthenticationProperties
             {
-                RedirectUri = redirectUri,
+                RedirectUri = redirectUri,                
             });
         });
 
         app.MapGet("/logout", async (HttpContext context, IHttpClientFactory httpClientFactory, IOptions<AuthentikSettings> settings) =>
         {
-            var authOptions = settings.Value;
-            var accessToken = await context.GetTokenAsync("access_token");
-
-            if (!string.IsNullOrEmpty(accessToken))
-            {
-                try
-                {
-                    var client = httpClientFactory.CreateClient();
-
-                    var requestContent = new FormUrlEncodedContent(new Dictionary<string, string>(StringComparer.Ordinal)
-                    {
-                        { "token", accessToken },
-                        { "client_id", authOptions.ClientId! },
-                        { "client_secret", authOptions.ClientSecret! },
-                    });
-
-                    await client.PostAsync(authOptions.RevokationEndpoint, requestContent, context.RequestAborted);
-                }
-                catch { }
-            }
-
             await context.SignOutAsync(CookieAuthenticationDefaults.AuthenticationScheme);
 
-            return Results.Redirect($"{authOptions.Authority}end-session/");
+            string currentBaseUrl = $"https://{context.Request.Host}{context.Request.PathBase}/";
+
+            await context.SignOutAsync(OpenIdConnectDefaults.AuthenticationScheme, new AuthenticationProperties
+            {
+                RedirectUri = currentBaseUrl
+            });
         });
 
         return app;