CODEWITHSUNDEEP
asp.net-coreopenid-connectopeniddict
Farouk Merawza
Farouk Merawza

Reputation: 45

Oppeniddict - How to skip logout prompt?

I am using velusia sample, I want the client app to skip the log out prompt page, is there any specific way to achieve this, or should I implement it my self ?

Upvotes: 0

Views: 3150

Answers (3)

JackAntono
JackAntono

Reputation: 1

You can also change the HTTP method to GET instead of POST based on Velusia sample:

[HttpGet("logout")]
public async Task<IActionResult> LogoutPost()
{
    await HttpContext.SignOutAsync(Clients.CmsApp);
    await HttpContext.SignOutAsync(OpenIddictServerAspNetCoreDefaults.AuthenticationScheme);

    return SignOut(
        authenticationSchemes: OpenIddictServerAspNetCoreDefaults.AuthenticationScheme,
        properties: new AuthenticationProperties
        {
            RedirectUri = "/"
        });
}

Upvotes: 0

K&#233;vin Chalet
K&#233;vin Chalet

Reputation: 42030

How you handle logout requests is up to you. To trigger a redirection to the client application (when a post_logout_redirect_uri is set) without displaying a consent form, trigger an ASP.NET Core Logout operation pointing to OpenIddict:

// Returning a SignOutResult will ask OpenIddict to redirect the user agent
// to the post_logout_redirect_uri specified by the client application or to
// the RedirectUri specified in the authentication properties if none was set.
return SignOut(
    authenticationSchemes: OpenIddictServerAspNetCoreDefaults.AuthenticationScheme,
    properties: new AuthenticationProperties
    {
        RedirectUri = "/"
    });

That said, I wouldn't recommend doing that: not requiring user consent or a form of anti-forgery protection - the id_token_hint can help, use AuthenticateAsync() to retrieve the principal from it - may make targeted DOS attacks possible.

Upvotes: 2

Brando Zhang
Brando Zhang

Reputation: 28067

According to your description, I suggest you could try to set a js code to automatically click the logout button in the server side.

More details, you could refer to below codes:

Modify the server's logout view as below:

@using Microsoft.Extensions.Primitives

<div class="jumbotron">
    <h1>Log out</h1>
    <p class="lead text-left">Are you sure you want to sign out?</p>

    <form asp-controller="Authorization" asp-action="Logout" method="post">
        @* Flow the request parameters so they can be received by the LogoutPost action: *@
        @foreach (var parameter in Context.Request.HasFormContentType ?
           (IEnumerable<KeyValuePair<string, StringValues>>) Context.Request.Form : Context.Request.Query)
        {
            <input type="hidden" name="@parameter.Key" value="@parameter.Value" />
        }

        <input class="btn btn-lg btn-success" id="Confirm" name="Confirm" type="submit" value="Yes" />
    </form>

  
</div>
@section scripts{

<script>
$(document).ready(function() {
    console.log("Fired");
   document.getElementById("Confirm").click();
});
</script>
 

}

Upvotes: 1

Related Questions