Repository navigation
Logout authentication session handling deletes shared roots, reuses tabs across sessions, and leaves auth session hash stale #55118
Description
Before reporting an issue
- I have read and understood the above terms for submitting issues, and I understand that my issue may be closed without action if I do not follow them.
Area
authentication
Describe the bug
Following the changes in #54942 (session takeover fix for logout auth sessions), three related edge cases in logout authentication session lifecycle and cookie synchronization remain open:
-
backchannelLogoutdeletes shared root authentication session containing unrelated login tabs (PR review r4517402901):AuthenticationManager.backchannelLogoutremoves the entire root authentication session in itsfinallyblock assuming the root is dedicated to the logout. When the logout session is created in or joined to a shared root (e.g., matchingAUTH_SESSION_IDcookie or matching user session ID), unrelated in-progress login tabs in that root are deleted, forcing users to restart their login. -
Logout auth session in a shared root is reused across different user sessions without clearing per-client logout states (PR review r4517402976):
AuthenticationManager.createOrJoinLogoutSessionlooks up any existing tab with actionLOGGING_OUTin the root and reuses it without verifying that theLOGOUT_USER_SESSION_IDauth note matches the user session being logged out. Stale per-client logout markers (LOGGED_OUT,LOGGING_OUTset bysetClientLogoutAction) from an earlier, unfinished logout of a different user session are retained, which can suppress logout notifications to downstream clients of the new user session. -
Stale
KC_AUTH_SESSION_HASHcookie when creating a new logout root (PR review r4540170938):AuthenticationManager.bindLogoutRootToBrowserupdates theAUTH_SESSION_IDcookie when creating a new random logout root, but does not updateKC_AUTH_SESSION_HASH. The hash cookie can retain the hash of the prior root for up to 60 seconds. If an abandoned logout confirmation is followed by aprompt=loginrequest joining that root,authChecker.jsencounters a hash mismatch and repeatedly reloads the login form until the hash cookie expires.
Version
main (999.0.0-SNAPSHOT)
Regression
- The issue is a regression
Expected behavior
backchannelLogoutshould only remove the logout authentication session tab, and delete the root authentication session only when no other tabs remain (or only if the root was created specifically for that logout).createOrJoinLogoutSessionshould verifyLOGOUT_USER_SESSION_IDbefore reusing an existingLOGGING_OUTtab in the root; if the user session differs, it should remove the old tab and create a fresh one without stale client states.bindLogoutRootToBrowsershould synchronize theKC_AUTH_SESSION_HASHcookie alongsideAUTH_SESSION_IDwhenever a new logout root is bound to the browser.
Actual behavior
- Unrelated login tabs in the shared root are deleted during backchannel logout.
- An existing logout session tab is reused across user sessions, retaining stale per-client logout states that may suppress downstream client logout notifications.
KC_AUTH_SESSION_HASHis left stale when a new logout root is assigned, causing repeated client-side login form reloads inauthChecker.js.
How to Reproduce?
Item 1 (Shared root deletion):
- Open a login page in a browser to create an in-progress login tab in root R with an
AUTH_SESSION_IDcookie for R (and no identity cookie). - Open
/protocol/openid-connect/logout?id_token_hint=<valid id token of another user session>in the same browser. - The fallback backchannel logout runs and deletes root R, destroying the login tab from step 1.
Item 2 (Cross-session logout tab reuse):
- Start a logout for user session A that does not complete (e.g. abandoned confirmation screen).
- In the same browser/root, initiate a logout for user session B.
createOrJoinLogoutSessionreuses A's logout session for B with A's client logout states intact.
Item 3 (Stale hash cookie reload loop):
- Log in, then trigger a logout flow that creates a new random logout root and updates
AUTH_SESSION_ID(without updatingKC_AUTH_SESSION_HASH). - Abandon the logout confirmation and initiate a new login with
prompt=loginwithin 60 seconds. authChecker.jsdetects a hash mismatch withKC_AUTH_SESSION_HASHand repeatedly reloads the page.
Anything else?
Spotted during code review of PR #54942:
Activity