Merge pull request 'Passing token hint during signout' (#92) from payments into master

Reviewed-on: #92

LiteCharms.Features/Extensions/Api.cs

@@ -10,7 +10,7 @@ public static class Api
     public const string Books = nameof(Books);
     public const string Payments = nameof(Payments);
 
-    public static IServiceCollection AddLiteCharmsUiSecurity(this IServiceCollection services, IConfiguration configuration)
+    public static IServiceCollection AddLiteCharmsWebSecurity(this IServiceCollection services, IConfiguration configuration)
     {
         var configSection = configuration.GetSection(nameof(LiteCharmsSettings));
 
@@ -27,13 +27,12 @@ public static class Api
         .AddCookie(CookieAuthenticationDefaults.AuthenticationScheme)
         .AddOpenIdConnect(OpenIdConnectDefaults.AuthenticationScheme, options =>
         {
-            options.Authority = authOptions.Authority;           
+            options.Authority = authOptions.Authority;
 
             options.ClientId = authOptions.ClientId;
             options.ClientSecret = authOptions.ClientSecret;
-            options.SignedOutCallbackPath = "/signout-callback-oidc";
-
             options.ResponseType = "code";
+
             options.SaveTokens = true;
             options.GetClaimsFromUserInfoEndpoint = true;
 
@@ -42,15 +41,27 @@ public static class Api
             options.Scope.Add("profile");
             options.Scope.Add("email");
 
-            options.CorrelationCookie.SecurePolicy = CookieSecurePolicy.Always;
+            options.Events = new OpenIdConnectEvents
-            options.CorrelationCookie.SameSite = SameSiteMode.None;
+            {
-            options.CorrelationCookie.HttpOnly = true;
+                OnRedirectToIdentityProviderForSignOut = context =>
+                {
+                    var idToken = context.ProtocolMessage.IdTokenHint;
 
-            options.NonceCookie.SecurePolicy = CookieSecurePolicy.Always;
+                    if (string.IsNullOrEmpty(idToken))
-            options.NonceCookie.SameSite = SameSiteMode.None;
+                    {
-            options.NonceCookie.HttpOnly = true;
+                        var tokens = context.Properties.GetTokens();
+                        var idTokenItem = tokens.FirstOrDefault(t => string.Equals(t.Name, "id_token", StringComparison.Ordinal));
+
+                        if (idTokenItem != null) context.ProtocolMessage.IdTokenHint = idTokenItem.Value;
+                    }
+
+                    return Task.CompletedTask;
+                },
+            };
         });
 
+        services.AddCascadingAuthenticationState();
+
         return services;
     }
 
@@ -71,7 +82,7 @@ public static class Api
                 options.TokenValidationParameters = new TokenValidationParameters
                 {
                     ValidIssuer = authOptions.Authority,
-                    ValidateAudience = false,
+                    ValidateAudience = true,
                     ValidateIssuer = true,
                 };
             });
@@ -87,20 +98,21 @@ public static class Api
         {
             await context.ChallengeAsync(OpenIdConnectDefaults.AuthenticationScheme, new AuthenticationProperties
             {
-                RedirectUri = redirectUri,                
+                RedirectUri = redirectUri,
             });
         });
 
-        app.MapGet("/logout", async (HttpContext context, IHttpClientFactory httpClientFactory, IOptions<LiteCharmsSettings> settings) =>
+        app.MapGet("/logout", async (HttpContext context) =>
         {
+            var idToken = await context.GetTokenAsync("id_token");
+
+            var authProperties = new AuthenticationProperties { RedirectUri = "/", };
+
+            if (!string.IsNullOrEmpty(idToken)) 
+                authProperties.Parameters.Add("id_token_hint", idToken);
+
+            await context.SignOutAsync(OpenIdConnectDefaults.AuthenticationScheme, authProperties);
             await context.SignOutAsync(CookieAuthenticationDefaults.AuthenticationScheme);
-
-            string currentBaseUrl = $"https://{context.Request.Host}{context.Request.PathBase}/";
-
-            await context.SignOutAsync(OpenIdConnectDefaults.AuthenticationScheme, new AuthenticationProperties
-            {
-                RedirectUri = currentBaseUrl
-            });
         });
 
         return app;