mirror of
https://github.com/outline/outline.git
synced 2026-08-03 13:27:25 +03:00
533efdfcfe
* fix: OIDC 502 on sign-in from oversized id_token cookie (#12986) Storing the full OIDC id_token in the `oidcIdToken` cookie inflated the sign-in response headers enough to exceed reverse proxy buffers, causing a 502 Bad Gateway. Store the id_token server-side in Redis keyed by a short session identifier and keep only that identifier in the cookie, preserving spec-compliant RP-initiated logout via `id_token_hint`. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * fix: Make OIDC logout token persistence best-effort A Redis failure when storing or reading the logout id_token_hint should not block sign-in or logout; fall back to omitting the hint instead. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * docs * refactor: Extract portable LogoutTokenStore for provider logout hints Move the cookie-referenced, Redis-backed logout token persistence out of the OIDC router into a provider-agnostic `LogoutTokenStore`. Any auth provider that supports provider-initiated logout can now persist and consume a logout hint via `new LogoutTokenStore(providerId)` without duplicating the cookie/Redis/error handling. The OIDC-specific end-session URL construction stays in the router. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>