c60cc7ca75
Some checks failed
CI / Run tests and lints (push) Failing after 29s
CI / Build CLI docs (push) Has been skipped
CI / Run Playwright end-to-end tests (mysql) (push) Failing after 3s
CI / Run Playwright end-to-end tests (postgres) (push) Failing after 2s
CI / Run Playwright end-to-end tests (sqlite) (push) Failing after 3s
CodeQL / Analyze (go) (push) Failing after 4s
CodeQL / Analyze (javascript) (push) Failing after 3s
Docker Image Scanners / scanners (push) Failing after 4s
Synchronize Issue Labels / Synchronize Issue Labels (push) Has been skipped
CI / Run end-to-end tests (postgres) (push) Failing after 19s
CI / Run end-to-end tests (sqlite) (push) Failing after 2s
CI / Run Playwright end-to-end tests (cockroach) (push) Failing after 2s
CI / Draft newsletter (push) Has been skipped
CI / Generate release (push) Has been skipped
CI / Pending approval Slack notification (push) Has been skipped
CI / Send newsletter (push) Has been skipped
75 lines
2.7 KiB
Go
75 lines
2.7 KiB
Go
// Copyright © 2026 Ory Corp
|
|
// SPDX-License-Identifier: Apache-2.0
|
|
|
|
package logout_test
|
|
|
|
import (
|
|
"context"
|
|
"net/http"
|
|
"net/url"
|
|
"testing"
|
|
|
|
"github.com/stretchr/testify/assert"
|
|
"github.com/stretchr/testify/require"
|
|
"github.com/tidwall/gjson"
|
|
|
|
"github.com/ory/kratos/driver/config"
|
|
"github.com/ory/kratos/pkg"
|
|
"github.com/ory/kratos/pkg/testhelpers"
|
|
"github.com/ory/kratos/x"
|
|
)
|
|
|
|
func TestLogoutClearSiteData(t *testing.T) {
|
|
ctx := context.Background()
|
|
conf, reg := pkg.NewFastRegistryWithMocks(t)
|
|
testhelpers.SetDefaultIdentitySchema(conf, "file://./stub/identity.schema.json")
|
|
public, _, publicRouter, _ := testhelpers.NewKratosServerWithCSRFAndRouters(t, reg)
|
|
publicRouter.GET("/session/browser/set", func(w http.ResponseWriter, r *http.Request) {
|
|
testhelpers.MockSetSession(t, reg, conf)(w, r)
|
|
})
|
|
conf.MustSet(ctx, config.ViperKeySelfServiceLogoutBrowserDefaultReturnTo, public.URL+"/")
|
|
|
|
// Resolve the submit URL and token for a fresh session, then issue the logout
|
|
// without following the redirect so we can inspect the 303 response headers.
|
|
logout := func(t *testing.T, forwardedProto string) *http.Response {
|
|
hc := testhelpers.NewSessionClient(t, public.URL+"/session/browser/set")
|
|
|
|
u, err := url.Parse(public.URL + "/self-service/logout/browser")
|
|
require.NoError(t, err)
|
|
body, res := testhelpers.HTTPRequestJSON(t, hc, "GET", u.String(), nil)
|
|
require.EqualValues(t, http.StatusOK, res.StatusCode)
|
|
logoutURL := gjson.GetBytes(body, "logout_url").String()
|
|
require.NotEmpty(t, logoutURL)
|
|
|
|
hc.CheckRedirect = func(*http.Request, []*http.Request) error { return http.ErrUseLastResponse }
|
|
req, err := http.NewRequest("GET", logoutURL, nil)
|
|
require.NoError(t, err)
|
|
if forwardedProto != "" {
|
|
req.Header.Set("X-Forwarded-Proto", forwardedProto)
|
|
}
|
|
out, err := hc.Do(req)
|
|
require.NoError(t, err)
|
|
t.Cleanup(func() { _ = out.Body.Close() })
|
|
require.Equal(t, http.StatusSeeOther, out.StatusCode, "%s", x.MustReadAll(out.Body))
|
|
return out
|
|
}
|
|
|
|
t.Run("case=flag disabled does not set header", func(t *testing.T) {
|
|
conf.MustSet(ctx, config.ViperKeySelfServiceLogoutClearBrowserData, false)
|
|
res := logout(t, "https")
|
|
assert.Empty(t, res.Header.Get("Clear-Site-Data"))
|
|
})
|
|
|
|
t.Run("case=flag enabled over https sets header", func(t *testing.T) {
|
|
conf.MustSet(ctx, config.ViperKeySelfServiceLogoutClearBrowserData, true)
|
|
res := logout(t, "https")
|
|
assert.Equal(t, `"cookies", "storage", "cache"`, res.Header.Get("Clear-Site-Data"))
|
|
})
|
|
|
|
t.Run("case=flag enabled over http does not set header", func(t *testing.T) {
|
|
conf.MustSet(ctx, config.ViperKeySelfServiceLogoutClearBrowserData, true)
|
|
res := logout(t, "http")
|
|
assert.Empty(t, res.Header.Get("Clear-Site-Data"))
|
|
})
|
|
}
|