Make id_token_hint optional for RP-initiated logout by madurangasiriwardena · Pull Request #4299 · thunder-id/thunderid

madurangasiriwardena · 2026-07-23T16:22:41Z

Purpose

Makes id_token_hint optional for OIDC RP-Initiated Logout. Previously the logout endpoint rejected any request that supplied post_logout_redirect_uri without an id_token_hint.

Per the RP-Initiated Logout spec, the OP may perform post-logout redirection without an id_token_hint as long as it confirms the legitimacy of the redirection target by other means, and per RPLogout it MUST ask the End-User to confirm the logout when no id_token_hint was provided. This PR implements both: a logout carrying only client_id now resolves (the redirect target is still validated against the client's registered allow-list), and when no valid hint is present the sign-out flow can prompt the user to confirm before the session is terminated.

A new "Confirm Sign Out Without a Hint" flow-builder template wires up this conditional-confirmation behavior.

Approach

Relax the requirement (internal/oauth/oauth2/logout): dropped the "id_token_hint required when post_logout_redirect_uri is present" check. A request with only client_id (with or without a registered post_logout_redirect_uri) now resolves; at least one of id_token_hint/client_id is still required, and post_logout_redirect_uri is still validated against the client's registered list, which serves as the spec's "other means of confirming the redirection target."
Signal the prompt requirement: when no valid id_token_hint was supplied, Resolve marks the resolution PromptRequired, and InitiateSignOutFlow passes logoutPromptRequired into the sign-out flow via RuntimeData.
Confirm in the executor (SessionSignOutExecutor): when the sign-out node opts in via the promptOnSignOut property and logoutPromptRequired is set, the executor returns the incomplete state so the engine routes to the node's onIncomplete confirmation prompt, terminating the session only after the user confirms (guarded to prompt once per run). Nodes that do not opt in terminate as before, so the existing always-prompt default sign-out flow is unchanged.
Key design decision: the conditional behavior is expressed with builder-native constructs (an onIncomplete edge plus a node property) rather than a node-level execution condition, because those already render and round-trip in the flow editor. This is why the confirmation logic lives in the executor instead of a graph condition.
Template: added a SIGNOUT flow-builder template with this wiring so developers can adopt it from the Console flow builder.

Prompt logout consent always

Prompt logout consent when id_token_hint is not provided

Available flow templates

Related Issues

Session logout support #2036

Related PRs

N/A

Checklist

Security checks

Followed secure coding standards in WSO2 Secure Coding Guidelines
Confirmed that this PR doesn't commit any keys, passwords, tokens, usernames, or other secrets.

Summary by CodeRabbit

New Features
- Added optional end-user confirmation for RP-initiated sign-out when a valid ID token hint is unavailable.
- Introduced a configurable “Prompt for Confirmation” setting on the session sign-out executor (default off).
- Added a conditional sign-out flow template that prompts only when needed.
- Kept redirect validation intact for logout requests.
Bug Fixes
- Avoided repeated confirmation prompts within the same sign-out flow run.
- Ensured sign-out proceeds correctly after confirmation or when prompting is disabled.
Tests
- Added/updated coverage for prompt routing and sign-out behavior across new scenarios.

coderabbitai · 2026-07-23T16:22:49Z

Warning

Review limit reached

@madurangasiriwardena, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 1 minute

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 09070aa7-76f6-41fc-950f-a472c8d07c75

📥 Commits

Reviewing files that changed from the base of the PR and between 4c26526 and 35dfe14.

📒 Files selected for processing (16)

backend/internal/flow/common/constants.go
backend/internal/flow/executor/constants.go
backend/internal/flow/executor/session_signout_executor.go
backend/internal/flow/executor/session_signout_executor_test.go
backend/internal/oauth/oauth2/logout/service.go
backend/internal/oauth/oauth2/logout/service_test.go
frontend/apps/console/src/features/flows/data/templates.json
frontend/apps/console/src/features/flows/models/__tests__/steps.test.ts
frontend/apps/console/src/features/flows/models/steps.ts
frontend/apps/console/src/features/flows/utils/__tests__/resolveStepMetadata.test.ts
frontend/apps/console/src/features/login-flow/components/resource-property-panel/extended-properties/ExecutionExtendedProperties.tsx
frontend/apps/console/src/features/login-flow/components/resource-property-panel/extended-properties/__tests__/ExecutionExtendedProperties.test.tsx
frontend/apps/console/src/features/login-flow/components/resource-property-panel/extended-properties/execution-properties/SessionSignOutProperties.tsx
frontend/apps/console/src/features/login-flow/components/resource-property-panel/extended-properties/execution-properties/constants.ts
frontend/apps/console/src/features/login-flow/data/executors.json
frontend/packages/i18n/src/locales/en-US.ts

📝 Walkthrough

Walkthrough

Adds RP-initiated logout confirmation when id_token_hint is absent, including backend runtime signaling and sign-out routing, executor tests, console configuration, localized properties, and a conditional sign-out flow template.

Changes

Logout confirmation flow

Layer / File(s)	Summary
Logout resolution and runtime signaling `backend/internal/flow/common/constants.go`, `backend/internal/oauth/oauth2/logout/...`	Logout resolution records whether confirmation is required, validates redirect URIs, and passes the prompt flag into sign-out flow runtime data.
Prompt-before-terminate execution `backend/internal/flow/executor/...`	Session sign-out routes to user input when configured and required, records that the prompt was shown, and terminates the session on subsequent execution.
Console configuration and flow template `frontend/apps/console/src/features/flows/...`, `frontend/apps/console/src/features/login-flow/...`, `frontend/packages/i18n/src/locales/en-US.ts`	The console exposes `promptOnSignOut`, registers the executor, adds localized labels, and provides a conditional sign-out template with confirmation routing.

Estimated code review effort: 4 (Complex) | ~45 minutes

Sequence Diagram(s)

sequenceDiagram
  participant RP
  participant LogoutService
  participant SessionSignOutExecutor
  participant ConfirmationPrompt
  participant SSO
  RP->>LogoutService: Submit logout request without id_token_hint
  LogoutService->>SessionSignOutExecutor: Start flow with prompt required
  SessionSignOutExecutor->>ConfirmationPrompt: Request user confirmation
  ConfirmationPrompt->>SessionSignOutExecutor: Confirm sign-out
  SessionSignOutExecutor->>SSO: Terminate session

Suggested reviewers: donomalvindula, thiva-k, thamindudilshan

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 33.33% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes the main change: making id_token_hint optional for RP-initiated logout.
Description check	✅ Passed	The description covers Purpose, Approach, Related Issues, Related PRs, Checklist, and Security checks, matching the template well.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

codecov · 2026-07-23T16:40:48Z

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

coderabbitai

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

backend/internal/oauth/oauth2/logout/service.go (1)
187-236: 📐 Maintainability & Code Quality | 🟠 Major | ⚡ Quick win

🔴 Documentation Required
This PR introduces user-facing changes that are not covered by documentation updates under docs/.
Please update the relevant documentation before merging.

Missing documentation:

backend/internal/oauth/oauth2/logout/service.go#L187-L236: Document optional id_token_hint, client_id-based logout resolution, confirmation behavior, and redirect validation in docs/content/apis.mdx.

frontend/apps/console/src/features/login-flow/data/executors.json#L948-L950: Document promptOnSignOut and the conditional sign-out flow/template in an appropriate docs/content/guides/ page.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@backend/internal/oauth/oauth2/logout/service.go` around lines 187 - 236,
Document the new sign-out behavior in docs/content/apis.mdx for
logoutService.Resolve: explain that id_token_hint is optional, client_id can
resolve the client, missing hints require user confirmation, and
post_logout_redirect_uri must match the client’s registered redirects. Also
document promptOnSignOut and its conditional sign-out flow/template in an
appropriate docs/content/guides/ page, covering the executor configuration at
frontend/apps/console/src/features/login-flow/data/executors.json lines 948-950.
Source: Path instructions

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Outside diff comments:
In `@backend/internal/oauth/oauth2/logout/service.go`:
- Around line 187-236: Document the new sign-out behavior in
docs/content/apis.mdx for logoutService.Resolve: explain that id_token_hint is
optional, client_id can resolve the client, missing hints require user
confirmation, and post_logout_redirect_uri must match the client’s registered
redirects. Also document promptOnSignOut and its conditional sign-out
flow/template in an appropriate docs/content/guides/ page, covering the executor
configuration at
frontend/apps/console/src/features/login-flow/data/executors.json lines 948-950.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: a8438114-bf6d-4084-85f9-5adcfa0b930f

📥 Commits

Reviewing files that changed from the base of the PR and between 189e635 and 633c296.

📒 Files selected for processing (15)

backend/internal/flow/common/constants.go
backend/internal/flow/executor/constants.go
backend/internal/flow/executor/session_signout_executor.go
backend/internal/flow/executor/session_signout_executor_test.go
backend/internal/oauth/oauth2/logout/service.go
backend/internal/oauth/oauth2/logout/service_test.go
frontend/apps/console/src/features/flows/data/templates.json
frontend/apps/console/src/features/flows/models/steps.ts
frontend/apps/console/src/features/flows/utils/__tests__/resolveStepMetadata.test.ts
frontend/apps/console/src/features/login-flow/components/resource-property-panel/extended-properties/ExecutionExtendedProperties.tsx
frontend/apps/console/src/features/login-flow/components/resource-property-panel/extended-properties/__tests__/ExecutionExtendedProperties.test.tsx
frontend/apps/console/src/features/login-flow/components/resource-property-panel/extended-properties/execution-properties/SessionSignOutProperties.tsx
frontend/apps/console/src/features/login-flow/components/resource-property-panel/extended-properties/execution-properties/constants.ts
frontend/apps/console/src/features/login-flow/data/executors.json
frontend/packages/i18n/src/locales/en-US.ts

ThaminduDilshan · 2026-07-24T10:23:28Z

+	// RuntimeKeyLogoutPromptShown is the session sign-out node's own guard, set when it routes to the
+	// confirmation prompt so that on re-run (after the user confirms) it terminates instead of
+	// prompting again.
+	RuntimeKeyLogoutPromptShown = "logoutPromptShown"


We have a type field in the prompt node action that can be used to indicate a metadata about the action edge. We should be able to improve this logic and get rid of this runtime data key by utilizing that.
Let's do it as a followup

Drop the requirement that id_token_hint accompany post_logout_redirect_uri. A logout carrying only client_id (with or without a registered post_logout_redirect_uri) now resolves; the redirect target is still confirmed against the client's registered allow-list, satisfying the OIDC RP-Initiated Logout requirement for confirming the redirection target. When no valid id_token_hint is supplied, the OAuth layer marks the sign-out flow with logoutPromptRequired. SessionSignOutExecutor reads it and, when its node opts in via the promptOnSignOut property, routes to the node's onIncomplete confirmation prompt before terminating the session, prompting once per flow run. Nodes that do not opt in terminate as before, leaving the always-prompt default sign-out flow unchanged. Add a Confirm Sign Out Without a Hint flow-builder template that wires this behavior with builder-native constructs (an onIncomplete edge and the promptOnSignOut property) so it renders and round-trips in the flow editor. Expose promptOnSignOut as an editable checkbox on the End Session executor in the Console flow editor, mirroring how other executors surface node properties. The property is a boolean, consistent with the provisioning executor's options.

Replace the RuntimeKeyLogoutPromptShown runtime-data guard on the session sign-out executor with the confirmation prompt's action type. When the End-User confirms, the prompt forwards its SIGN_OUT_CONFIRM action type to the executor on the re-run, so a confirmed request is told apart from the initial one without persisting a marker. Mark the confirmation button of the Conditional Sign Out Flow template with that type, both on the prompt action the engine reads and on the element itself, so the flow builder's Action selector shows Sign out for it and the type survives editing the flow. Refs thunder-id#4299

Replace the RuntimeKeyLogoutPromptShown runtime-data guard on the session sign-out executor with the confirmation prompt's action type. When the End-User confirms, the prompt forwards its SIGN_OUT_CONFIRM action type to the executor on the re-run, so a confirmed request is told apart from the initial one without persisting a marker. Mark the confirmation button of the Conditional Sign Out Flow template with that type, both on the prompt action the engine reads and on the element itself, so the flow builder's Action selector shows Sign out for it and the type survives editing the flow. Document SIGN_OUT_CONFIRM alongside the existing SUBMIT and REJECT action types in the flow management and flow execution API specs and in the flow configuration guide. Refs thunder-id#4299

Replace the RuntimeKeyLogoutPromptShown runtime-data guard on the session sign-out executor with the confirmation prompt's action type. When the End-User confirms, the prompt forwards its SIGN_OUT_CONFIRM action type to the executor on the re-run, so a confirmed request is told apart from the initial one without persisting a marker. Mark the confirmation button of the Conditional Sign Out Flow template with that type, both on the prompt action the engine reads and on the element itself, so the flow builder's Action selector shows Sign out for it and the type survives editing the flow. Describe prompts[].action.type as an opaque string owned by the consuming executor instead of enumerating its values in the flow management and flow execution API specs and in the flow configuration guide. The field already accepted arbitrary strings, so the enumerations were never the contract, and they would need editing in three places for every action type added. Refs thunder-id#4299

Replace the RuntimeKeyLogoutPromptShown runtime-data guard on the session sign-out executor with the confirmation prompt's action type. When the End-User confirms, the prompt forwards its SIGN_OUT_CONFIRM action type to the executor on the re-run, so a confirmed request is told apart from the initial one without persisting a marker. Resolve that into an outcome by dispatching on the forwarded action type rather than comparing against the confirm type alone, so the confirmation prompt can grow further actions: each action type the prompt raises maps to one signOutOutcome, and an unrecognized type is treated as no consent and prompts again rather than falling through to termination. Mark the confirmation button of the Conditional Sign Out Flow template with that type, both on the prompt action the engine reads and on the element itself, so the flow builder's Action selector shows Sign out for it and the type survives editing the flow. Describe prompts[].action.type as an opaque string owned by the consuming executor instead of enumerating its values in the flow management and flow execution API specs and in the flow configuration guide. The field already accepted arbitrary strings, so the enumerations were never the contract, and they would need editing in three places for every action type added. Refs thunder-id#4299

The prompt action's type was write-only in the console: serialization emitted prompts[].action.type from the button element's actionType, but the load path never read it back and FlowNodeAction did not even declare the field. A flow definition authored outside the builder therefore lost its action type on the first save, and the Action selector showed the wrong option for it. Restore the type onto the element when a definition is loaded, so the property panel can display it and serialization emits it again. The element wins when it already carries a type, because an unwired button holds the only copy: a prompt action is emitted only once the button has a nextNode. Clear only the type the selector owns when the author picks a plain action. SUBMIT and REJECT are documented prompt action types with no option in the dropdown, and blanket clearing discarded them. Key the Sign out option on SIGN_OUT_CONFIRM rather than a UI-only SIGN_OUT sentinel, so the value selected in the editor and the value in the flow definition are one vocabulary, and label it Sign Out Action to match the Submit Form and Trigger Action options beside it. Refs thunder-id#4299

Rename the prompt action type the session sign-out executor reads from SIGN_OUT_CONFIRM to CONFIRM, in the backend constant and in the console's PromptActionTypes, and update the Conditional Sign Out Flow template. Forwarding a prompt action's type to the next node's executor is a generic mechanism, so naming the value after one use case would push every executor that routes to a confirmation prompt to add a near-identical constant of its own. CONFIRM is the vocabulary rather than SIGN_OUT_CONFIRM; the session sign-out executor is its first consumer, not its only possible one. Rename the Action selector's option to match, from Sign Out Action under core.buttonExtendedProperties.action.signOut to Confirm Action under core.buttonExtendedProperties.action.confirm. Leaving it named for signing out while it writes the generic type would offer no option an author could pick to confirm anything else. The sign-out validation rule keeps its own notification identifiers and its sign-out wording: it checks that a confirmation button leads to a session sign-out step, which stays specific to sign-out flows even though the action type it looks for no longer is. Refs thunder-id#4299

madurangasiriwardena added Type/Improvement trigger-pr-builder Add when the PR is ready for CI; starts the PR Builder for this and all later pushes labels Jul 23, 2026

madurangasiriwardena removed the trigger-pr-builder Add when the PR is ready for CI; starts the PR Builder for this and all later pushes label Jul 24, 2026

madurangasiriwardena force-pushed the optional-id-token-hint-logout branch from 1de09e8 to 633c296 Compare July 24, 2026 05:38

madurangasiriwardena marked this pull request as ready for review July 24, 2026 07:01

madurangasiriwardena requested review from DonOmalVindula, ThaminduDilshan, brionmario, jeradrutnam and thiva-k as code owners July 24, 2026 07:01

coderabbitai Bot reviewed Jul 24, 2026

View reviewed changes

ThaminduDilshan previously approved these changes Jul 24, 2026

View reviewed changes

ThaminduDilshan added the trigger-pr-builder Add when the PR is ready for CI; starts the PR Builder for this and all later pushes label Jul 24, 2026

ThaminduDilshan enabled auto-merge July 24, 2026 10:25

madurangasiriwardena dismissed ThaminduDilshan’s stale review via 4c26526 July 24, 2026 13:06

madurangasiriwardena force-pushed the optional-id-token-hint-logout branch from 633c296 to 4c26526 Compare July 24, 2026 13:06

madurangasiriwardena force-pushed the optional-id-token-hint-logout branch from 4c26526 to 35dfe14 Compare July 24, 2026 13:27

rajithacharith approved these changes Jul 24, 2026

View reviewed changes

ThaminduDilshan added this pull request to the merge queue Jul 24, 2026

github-merge-queue Bot removed this pull request from the merge queue due to failed status checks Jul 24, 2026

madurangasiriwardena added this pull request to the merge queue Jul 24, 2026

github-merge-queue Bot removed this pull request from the merge queue due to failed status checks Jul 24, 2026

rajithacharith added this pull request to the merge queue Jul 24, 2026

Merged via the queue into thunder-id:main with commit 4e057d3 Jul 24, 2026
26 checks passed

This was referenced Jul 31, 2026

Sign out without a confirmation prompt #4455

Merged

Document session logout for OIDC and app-native flows #4291

Merged

This was referenced Jul 31, 2026

Signal sign-out confirmation with the prompt action type #4480

Merged

Round-trip the prompt action type through the flow builder #4481

Merged

coderabbitai Bot mentioned this pull request Aug 3, 2026

Make the confirmation prompt action type generic #4519

Merged

12 tasks

Navigation Menu

Uh oh!

Make id_token_hint optional for RP-initiated logout - #4299

Make id_token_hint optional for RP-initiated logout#4299
rajithacharith merged 1 commit into
thunder-id:mainfrom
madurangasiriwardena:optional-id-token-hint-logout

madurangasiriwardena commented Jul 23, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

coderabbitai Bot commented Jul 23, 2026 •

edited

Loading

Review limit reached

Walkthrough

Changes

Sequence Diagram(s)

❌ Failed checks (1 warning)

Uh oh!

codecov Bot commented Jul 23, 2026

Uh oh!

coderabbitai Bot left a comment

Uh oh!

ThaminduDilshan Jul 24, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

madurangasiriwardena commented Jul 23, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Purpose

Approach

Related Issues

Related PRs

Checklist

Security checks

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Jul 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review limit reached

Walkthrough

Changes

Sequence Diagram(s)

❌ Failed checks (1 warning)

Uh oh!

codecov Bot commented Jul 23, 2026

Codecov Report

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

ThaminduDilshan Jul 24, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

madurangasiriwardena commented Jul 23, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Jul 23, 2026 •

edited

Loading