How do i get the Logout flow to work?

[dan2kx]

Im running Hydra and Kratos in a development environment using docker and a simple/default config and i don't seem to be able to get the logout flow to work as intended.

I have configured my third party client in Hydra by running the command:

docker-compose exec hydra \
 hydra clients create \     --endpoint http://localhost:4445 \
     --id next-client-test \
     --secret secret \
     --grant-types authorization_code,refresh_token \
     --response-types code,id_token \
     --scope openid,offline \
     --callbacks http://localhost:3003/api/auth/callback \
     --post-logout-callbacks http://localhost:3003

From the third party app i initiate a logout sequence when a user clicks a logout button:

async function handleLogout(req: NextApiRequest, res: NextApiResponse) {
  const logoutUrl = new URL("/oauth2/sessions/logout", hydraUrl);

  logoutUrl.searchParams.set("id_token_hint", req.cookies.id_token);
  logoutUrl.searchParams.set("post_logout_redirect_uri", selfUrl);
  logoutUrl.searchParams.set("state", state);

  res.writeHead(302, {
    Location: logoutUrl.toString(),
  });

  res.end();
}

I'm expecting that the browser is redirected to hydra and a logout_challenge is generated and added to the query parameters of my configured logout page (which is configured in the yaml file as below) which the user should be redirected to.

urls:
  self:
    issuer: http://localhost:4444
  consent: http://localhost:4455/oauth/authorize
  login: http://localhost:4455/oauth/login
  logout: http://localhost:4455/oauth/logout

I have configured my /oauth/logout page to take the logout challenge parameter and then accept the logout request.

The problem i'm having is eIther my login page is never hit, so the logout code is not executed (the user is returned to the post_logout_redirect_uri) or, if i remove the post_logout_redirect_uri from the logout request then my page is hit but there is no logout challenge in the url.

I'm not sure how to debug this or how to move forward so any pointers would be greatly appreciated.

• I have read the https://www.ory.sh/hydra/docs/debug/logout page and i am trying to initiate a Relying Party logout.
• I'm not mixing domain names
• I'm not running a proxy and have no other issues with cookies
• I'm not setting remember: true on my login request (i am on my consent request) but when i do the logout call i am sending the id_token_hint. I've tried both the id_token and the access_token. I have also tried setting remember: true on the login which creates a oauth2_authentication_session_insecure cookie but the behavior is the same.

Thanks for the help

[dan2kx]

Any ideas? This seems like an issue with hydra to me?

[vinckr]

Hello,
Apologies, missed this thread.

Did you make sure you have a cookie named oauth2_authentication_session for the URL ORY Hydra is running on, and for the domain that's in your http://.../oauth2/sessions/logout ?

[dan2kx]

I am instead sending the id_token_hint, i have tried setting remember to true so that the cookie will be present but i don't have a secure cookie locally so i'm guessing it didn't work because of that? My understanding is the id_token_hint doesn't require the cookie though?

[webB1an]

Any ideas? This seems like an issue with hydra to me?

Hello！Have you found any solution？

[vinckr]

Hey @dan2kx

Just for sanity, can you confirm it is not:

You are mixing up domain names (e.g. 127.0.0.1 and localhost - this is a common mistake)
or
You are using a Browser with a very strict privacy policy which makes it difficult or impossible for ORY Hydra to properly set cookies. We've observed that the Brave Browser is very, very difficult here.

To further help with debugging we would need some logs, info on setup (configs, hydra flags) etc.

[vinckr]

Hey @dan2kx , just checking in if your problem still persists.
I will mark this as answered for now, but feel free to come back to the discussion any time.
Thanks a ton 🐝