Loging out of Azure Passport authentication Node js

user_3211705 0
Viewed 2435

I have a node js application in which we have used azure login with passport authentication.

I have successfully logged in using azure and the application is working fine.

But, when I logged out and give the url to a page - it checks for authentication and automatically go to that page without asking for login.

Once I logged in my url contains below query string 1. session_state 2. code 3. state 4. token

Log in Code:

app.get('/login', passport.authenticate('azuread-openidconnect', { failureRedirect: '/' }), function (req, res) {
res.sendFile(path.join(__dirname+'/index.html'));

});

Logout code:

app.get('/logout', function (req, res) {
    req.session.destroy();
    req.logout();
    res.redirect('/');
});

When i logout the page redirects to my index page. Then when i give '/login' to the url it takes me to the page without going to logging in page

Please help to get out of this...

passport.js node.js azure
4 Answers

1) I had this same problem, as passpor-azure documented I was executing this function to logout:

 logout: function(req, res) {
    req.logout();
    res.redirect('/');
  }

But Azure login session keeps active, so when I re-enter into my website, the autentication request will automatically be valid and no login page will be showned.

I tried @Gary Liu - MSFT suggestion to configure prompt:login option, but has @user3211705 commented, this makes login page reappear (even if I don't do logout and I have a portal.azure.com tab open), for instance when I restart my server (note: this isn't wrong, but when we are developing, one restarts the server all the time, and it gets annoying to login all the time)

2) Part of my solution came from this post:

Which suggest to invoke this url to logout user at Azure AD:

https://login.microsoftonline.com/<tennantid>/oauth2/logout

But only doing this didn't do the job for all situations.

If I have my website open in more than one window/tab browser, the user gets invalid in Azure AD by invoking this url, but I can keep using my website at the other tab (it seems like the user in that tab session keeps still active).

This is similar to have my website in one tab and on another tab with the portal.azure.com open, and do logout in portal.azure.com which invalidate my user at Azure AD.

So my final solution was a mix of both

 logout: function(req, res) {
    req.logout();
    res.redirect('https://login.microsoftonline.com/<tennantid>/oauth2/logout');
  }

This does logout my user in the request and invokes logout authentication in Azure AD.

One can still add a redirect uri at logout url param ?post_logout_redirect_uri=

/oauth2/logout?post_logout_redirect_uri=<your website>
user_31990810
Related