products/bff/test/Bff.Tests/Endpoints/Management/LogoutEndpointTests.cs at 1c735ba112f60b142044786285c9a3b05236f401 · DuendeSoftware/products · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
// Copyright (c) Duende Software. All rights reserved.
// See LICENSE in the project root for license information.

using System.Net;
using Duende.Bff.Tests.TestHosts;
using Microsoft.Extensions.DependencyInjection;
using Xunit.Abstractions;

namespace Duende.Bff.Tests.Endpoints.Management
{
    public class LogoutEndpointTests(ITestOutputHelper output) : BffIntegrationTestBase(output)
    {
        [Fact]
        public async Task logout_endpoint_should_allow_anonymous()
        {
            BffHost.OnConfigureServices += svcs =>
            {
                svcs.AddAuthorization(opts =>
                {
                    opts.FallbackPolicy =
                        new Microsoft.AspNetCore.Authorization.AuthorizationPolicyBuilder()
                        .RequireAuthenticatedUser()
                        .Build();
                });
            };
            await BffHost.InitializeAsync();

            var response = await BffHost.BrowserClient.GetAsync(BffHost.Url("/bff/logout"));
            response.StatusCode.ShouldNotBe(HttpStatusCode.Unauthorized);
        }

        [Fact]
        public async Task logout_endpoint_should_signout()
        {
            await BffHost.BffLoginAsync("alice", "sid123");

            await BffHost.BffLogoutAsync("sid123");

            (await BffHost.GetIsUserLoggedInAsync()).ShouldBeFalse();
        }

        [Fact]
        public async Task logout_endpoint_for_authenticated_should_require_sid()
        {
            await BffHost.BffLoginAsync("alice", "sid123");

            var response = await BffHost.BrowserClient.GetAsync(BffHost.Url("/bff/logout"));
            response.StatusCode.ShouldBe(HttpStatusCode.BadRequest);

            (await BffHost.GetIsUserLoggedInAsync()).ShouldBeTrue();
        }

        [Fact]
        public async Task logout_endpoint_for_authenticated_when_require_option_is_false_should_not_require_sid()
        {
            await BffHost.BffLoginAsync("alice", "sid123");

            BffHost.BffOptions.RequireLogoutSessionId = false;

            var response = await BffHost.BrowserClient.GetAsync(BffHost.Url("/bff/logout"));
            response.StatusCode.ShouldBe(HttpStatusCode.Redirect); // endsession
            response.Headers.Location!.ToString().ToLowerInvariant().ShouldStartWith(IdentityServerHost.Url("/connect/endsession"));
        }

        [Fact]
        public async Task logout_endpoint_for_authenticated_user_without_sid_should_succeed()
        {
            // workaround for RevokeUserRefreshTokenAsync throwing when no RT in session
            BffHost.OnConfigureServices += svcs =>
            {
                svcs.Configure<BffOptions>(options =>
                {
                    options.RevokeRefreshTokenOnLogout = false;
                });
            };
            await BffHost.InitializeAsync();

            await BffHost.IssueSessionCookieAsync("alice");

            var response = await BffHost.BrowserClient.GetAsync(BffHost.Url("/bff/logout"));
            response.StatusCode.ShouldBe(HttpStatusCode.Redirect); // endsession
            response.Headers.Location!.ToString().ToLowerInvariant().ShouldStartWith(IdentityServerHost.Url("/connect/endsession"));
        }

        [Fact]
        public async Task logout_endpoint_for_anonymous_user_without_sid_should_succeed()
        {
            var response = await BffHost.BrowserClient.GetAsync(BffHost.Url("/bff/logout"));
            response.StatusCode.ShouldBe(HttpStatusCode.Redirect); // endsession
            response.Headers.Location!.ToString().ToLowerInvariant().ShouldStartWith(IdentityServerHost.Url("/connect/endsession"));
        }

        [Fact]
        public async Task logout_endpoint_should_redirect_to_external_signout_and_return_to_root()
        {
            await BffHost.BffLoginAsync("alice", "sid123");

            await BffHost.BffLogoutAsync("sid123");

            BffHost.BrowserClient.CurrentUri
                .ShouldNotBeNull()
                .ToString()
                .ToLowerInvariant()
                .ShouldBe(BffHost.Url("/"));

            (await BffHost.GetIsUserLoggedInAsync()).ShouldBeFalse();
        }

        [Fact]
        public async Task can_logout_twice()
        {
            await BffHost.BffLoginAsync("alice", "sid123");

            await BffHost.BffLogoutAsync("sid123");

            var response = await BffHost.BrowserClient.GetAsync(BffHost.Url("/bff/logout") + "?sid=123");
            response.StatusCode.ShouldBe(HttpStatusCode.Redirect); // endsession
            response.Headers.Location!.ToString().ToLowerInvariant().ShouldStartWith(IdentityServerHost.Url("/connect/endsession"));


            (await BffHost.GetIsUserLoggedInAsync()).ShouldBeFalse();
        }

        [Fact]
        public async Task logout_endpoint_should_accept_returnUrl()
        {
            await BffHost.BffLoginAsync("alice", "sid123");

            var response = await BffHost.BrowserClient.GetAsync(BffHost.Url("/bff/logout") + "?sid=sid123&returnUrl=/foo");
            response.StatusCode.ShouldBe(HttpStatusCode.Redirect); // endsession
            response.Headers.Location!.ToString().ToLowerInvariant().ShouldStartWith(IdentityServerHost.Url("/connect/endsession"));

            response = await IdentityServerHost.BrowserClient.GetAsync(response.Headers.Location!.ToString());
            response.StatusCode.ShouldBe(HttpStatusCode.Redirect); // logout
            response.Headers.Location!.ToString().ToLowerInvariant().ShouldStartWith(IdentityServerHost.Url("/account/logout"));

            response = await IdentityServerHost.BrowserClient.GetAsync(response.Headers.Location!.ToString());
            response.StatusCode.ShouldBe(HttpStatusCode.Redirect); // post logout redirect uri
            response.Headers.Location!.ToString().ToLowerInvariant().ShouldStartWith(BffHost.Url("/signout-callback-oidc"));

            response = await BffHost.BrowserClient.GetAsync(response.Headers.Location!.ToString());
            response.StatusCode.ShouldBe(HttpStatusCode.Redirect); // root
            response.Headers.Location!.ToString().ToLowerInvariant().ShouldBe("/foo");
        }

        [Fact]
        public async Task logout_endpoint_should_reject_non_local_returnUrl()
        {
            await BffHost.BffLoginAsync("alice", "sid123");

            var response = await BffHost.BrowserClient.GetAsync(BffHost.Url("/bff/logout") + "?sid=sid123&returnUrl=https://foo");
            response.StatusCode.ShouldBe(HttpStatusCode.BadRequest);
        }
    }
}