snapshot of https://github.com/ory/kratos.git (master, 2026-09-15; blobs > 131072B omitted)

selfservice/flow/logout/handler_clearsitedata_test.go

@@ -0,0 +1,74 @@
+// Copyright © 2026 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+package logout_test
+
+import (
+	"context"
+	"net/http"
+	"net/url"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"github.com/tidwall/gjson"
+
+	"github.com/ory/kratos/driver/config"
+	"github.com/ory/kratos/pkg"
+	"github.com/ory/kratos/pkg/testhelpers"
+	"github.com/ory/kratos/x"
+)
+
+func TestLogoutClearSiteData(t *testing.T) {
+	ctx := context.Background()
+	conf, reg := pkg.NewFastRegistryWithMocks(t)
+	testhelpers.SetDefaultIdentitySchema(conf, "file://./stub/identity.schema.json")
+	public, _, publicRouter, _ := testhelpers.NewKratosServerWithCSRFAndRouters(t, reg)
+	publicRouter.GET("/session/browser/set", func(w http.ResponseWriter, r *http.Request) {
+		testhelpers.MockSetSession(t, reg, conf)(w, r)
+	})
+	conf.MustSet(ctx, config.ViperKeySelfServiceLogoutBrowserDefaultReturnTo, public.URL+"/")
+
+	// Resolve the submit URL and token for a fresh session, then issue the logout
+	// without following the redirect so we can inspect the 303 response headers.
+	logout := func(t *testing.T, forwardedProto string) *http.Response {
+		hc := testhelpers.NewSessionClient(t, public.URL+"/session/browser/set")
+
+		u, err := url.Parse(public.URL + "/self-service/logout/browser")
+		require.NoError(t, err)
+		body, res := testhelpers.HTTPRequestJSON(t, hc, "GET", u.String(), nil)
+		require.EqualValues(t, http.StatusOK, res.StatusCode)
+		logoutURL := gjson.GetBytes(body, "logout_url").String()
+		require.NotEmpty(t, logoutURL)
+
+		hc.CheckRedirect = func(*http.Request, []*http.Request) error { return http.ErrUseLastResponse }
+		req, err := http.NewRequest("GET", logoutURL, nil)
+		require.NoError(t, err)
+		if forwardedProto != "" {
+			req.Header.Set("X-Forwarded-Proto", forwardedProto)
+		}
+		out, err := hc.Do(req)
+		require.NoError(t, err)
+		t.Cleanup(func() { _ = out.Body.Close() })
+		require.Equal(t, http.StatusSeeOther, out.StatusCode, "%s", x.MustReadAll(out.Body))
+		return out
+	}
+
+	t.Run("case=flag disabled does not set header", func(t *testing.T) {
+		conf.MustSet(ctx, config.ViperKeySelfServiceLogoutClearBrowserData, false)
+		res := logout(t, "https")
+		assert.Empty(t, res.Header.Get("Clear-Site-Data"))
+	})
+
+	t.Run("case=flag enabled over https sets header", func(t *testing.T) {
+		conf.MustSet(ctx, config.ViperKeySelfServiceLogoutClearBrowserData, true)
+		res := logout(t, "https")
+		assert.Equal(t, `"cookies", "storage", "cache"`, res.Header.Get("Clear-Site-Data"))
+	})
+
+	t.Run("case=flag enabled over http does not set header", func(t *testing.T) {
+		conf.MustSet(ctx, config.ViperKeySelfServiceLogoutClearBrowserData, true)
+		res := logout(t, "http")
+		assert.Empty(t, res.Header.Get("Clear-Site-Data"))
+	})
+}