Logout endpoint should handle idP POST response #84
Conversation
When mod_auth_mellon sends logout request to the idP, it gets response back through HTTP GET request. That works fine, However, some idP implementations send the logout response through POST request. Logout response via POST is not understood by mod_auth_mellon and leads to 404 page. The mod_auth_mellon assumes that POST method in logout endpoint is always SOAP logout request. The suggested fix adds a check and POST handler for logout responses.
|
Can you please drop the gratuitous formatting changes? |
|
Done. Reverted formatting part of the fix, I've no strong opinion on it. When learning the coding style that is used in auth_mellon_handler.c file, I just noticed the file is inconsistent in using tabs and spaces, somewhere the continuation line thus appears visually intended by 3 spaces, somewhere by 4 etc. I understand the file grows over time and accumulates fixes from different contributors. Unless the coding style is enforced by tools, it's difficult to maintain indentation. |
|
@simo5 Squashing commits to single one can be done automatically by Github. There should be "confirm squash and merge" button / option in WebUI (assuming squashing is enabled in repository settings). See:
|
When mod_auth_mellon sends logout request to the idP, it gets response back through HTTP GET request. That works fine, However, some idP implementations send the logout response through POST request. Logout response via POST is not understood by mod_auth_mellon and leads to 404 page. The mod_auth_mellon assumes that POST method in logout endpoint is always SOAP logout request. The suggested fix adds a check and POST handler for logout responses.
I also did re-tab in mellon_auth_handler.c source file since some portions of the file mixed tab and space based indentations.