strapi-plugin-oidc 1.5.2 → 1.5.3

package/dist/server/index.js

@@ -222,6 +222,7 @@ function clearAuthCookies(strapi2, ctx) {
   const options2 = getExpiredCookieOptions(strapi2, ctx);
   ctx.cookies.set("strapi_admin_refresh", "", options2);
   ctx.cookies.set("oidc_authenticated", "", { ...options2, path: "/" });
+  ctx.cookies.set("oidc_access_token", "", { ...options2, path: "/" });
 }
 const REQUIRED_CONFIG_KEYS = [
   "OIDC_CLIENT_ID",
@@ -303,7 +304,8 @@ async function exchangeTokenAndFetchUserInfo(config2, params, expectedNonce) {
   if (!userResponse.ok) {
     throw new Error("Failed to fetch user info");
   }
-  return userResponse.json();
+  const userInfo = await userResponse.json();
+  return { userInfo, accessToken: tokenData.access_token };
 }
 async function registerNewUser(userService, oauthService2, roleService2, email, userResponseData, whitelistUser, config2, ctx) {
   let roles2 = [];
@@ -369,13 +371,25 @@ async function oidcSignInCallback(ctx) {
   params.append("grant_type", config2.OIDC_GRANT_TYPE);
   params.append("code_verifier", codeVerifier ?? "");
   try {
-    const userResponseData = await exchangeTokenAndFetchUserInfo(config2, params, oidcNonce ?? "");
+    const { userInfo, accessToken } = await exchangeTokenAndFetchUserInfo(
+      config2,
+      params,
+      oidcNonce ?? ""
+    );
+    const isProduction = strapi.config.get("environment") === "production";
+    ctx.cookies.set("oidc_access_token", accessToken, {
+      httpOnly: true,
+      maxAge: 3e5,
+      // 5 minutes — matches typical provider access token lifetime
+      secure: isProduction && ctx.request.secure,
+      sameSite: "lax"
+    });
     const { activateUser, jwtToken } = await handleUserAuthentication(
       userService,
       oauthService2,
       roleService2,
       whitelistService2,
-      userResponseData,
+      userInfo,
       config2,
       ctx
     );
@@ -391,14 +405,26 @@ async function oidcSignInCallback(ctx) {
 async function logout(ctx) {
   const config2 = strapi.config.get("plugin::strapi-plugin-oidc");
   const logoutUrl = config2.OIDC_END_SESSION_ENDPOINT;
+  const adminPanelUrl = strapi.config.get("admin.url", "/admin");
   const isOidcSession = !!ctx.cookies.get("oidc_authenticated");
+  const accessToken = ctx.cookies.get("oidc_access_token");
   clearAuthCookies(strapi, ctx);
+  if (logoutUrl && isOidcSession && accessToken) {
+    try {
+      const response = await fetch(config2.OIDC_USERINFO_ENDPOINT, {
+        headers: { Authorization: `Bearer ${accessToken}` }
+      });
+      if (response.ok) {
+        return ctx.redirect(logoutUrl);
+      }
+    } catch {
+    }
+    return ctx.redirect(`${adminPanelUrl}/auth/login`);
+  }
   if (logoutUrl && isOidcSession) {
-    ctx.redirect(logoutUrl);
-  } else {
-    const adminPanelUrl = strapi.config.get("admin.url", "/admin");
-    ctx.redirect(`${adminPanelUrl}/auth/login`);
+    return ctx.redirect(logoutUrl);
   }
+  ctx.redirect(`${adminPanelUrl}/auth/login`);
 }
 const oidc = {
   oidcSignIn,

package/dist/server/index.mjs

@@ -216,6 +216,7 @@ function clearAuthCookies(strapi2, ctx) {
   const options2 = getExpiredCookieOptions(strapi2, ctx);
   ctx.cookies.set("strapi_admin_refresh", "", options2);
   ctx.cookies.set("oidc_authenticated", "", { ...options2, path: "/" });
+  ctx.cookies.set("oidc_access_token", "", { ...options2, path: "/" });
 }
 const REQUIRED_CONFIG_KEYS = [
   "OIDC_CLIENT_ID",
@@ -297,7 +298,8 @@ async function exchangeTokenAndFetchUserInfo(config2, params, expectedNonce) {
   if (!userResponse.ok) {
     throw new Error("Failed to fetch user info");
   }
-  return userResponse.json();
+  const userInfo = await userResponse.json();
+  return { userInfo, accessToken: tokenData.access_token };
 }
 async function registerNewUser(userService, oauthService2, roleService2, email, userResponseData, whitelistUser, config2, ctx) {
   let roles2 = [];
@@ -363,13 +365,25 @@ async function oidcSignInCallback(ctx) {
   params.append("grant_type", config2.OIDC_GRANT_TYPE);
   params.append("code_verifier", codeVerifier ?? "");
   try {
-    const userResponseData = await exchangeTokenAndFetchUserInfo(config2, params, oidcNonce ?? "");
+    const { userInfo, accessToken } = await exchangeTokenAndFetchUserInfo(
+      config2,
+      params,
+      oidcNonce ?? ""
+    );
+    const isProduction = strapi.config.get("environment") === "production";
+    ctx.cookies.set("oidc_access_token", accessToken, {
+      httpOnly: true,
+      maxAge: 3e5,
+      // 5 minutes — matches typical provider access token lifetime
+      secure: isProduction && ctx.request.secure,
+      sameSite: "lax"
+    });
     const { activateUser, jwtToken } = await handleUserAuthentication(
       userService,
       oauthService2,
       roleService2,
       whitelistService2,
-      userResponseData,
+      userInfo,
       config2,
       ctx
     );
@@ -385,14 +399,26 @@ async function oidcSignInCallback(ctx) {
 async function logout(ctx) {
   const config2 = strapi.config.get("plugin::strapi-plugin-oidc");
   const logoutUrl = config2.OIDC_END_SESSION_ENDPOINT;
+  const adminPanelUrl = strapi.config.get("admin.url", "/admin");
   const isOidcSession = !!ctx.cookies.get("oidc_authenticated");
+  const accessToken = ctx.cookies.get("oidc_access_token");
   clearAuthCookies(strapi, ctx);
+  if (logoutUrl && isOidcSession && accessToken) {
+    try {
+      const response = await fetch(config2.OIDC_USERINFO_ENDPOINT, {
+        headers: { Authorization: `Bearer ${accessToken}` }
+      });
+      if (response.ok) {
+        return ctx.redirect(logoutUrl);
+      }
+    } catch {
+    }
+    return ctx.redirect(`${adminPanelUrl}/auth/login`);
+  }
   if (logoutUrl && isOidcSession) {
-    ctx.redirect(logoutUrl);
-  } else {
-    const adminPanelUrl = strapi.config.get("admin.url", "/admin");
-    ctx.redirect(`${adminPanelUrl}/auth/login`);
+    return ctx.redirect(logoutUrl);
   }
+  ctx.redirect(`${adminPanelUrl}/auth/login`);
 }
 const oidc = {
   oidcSignIn,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "strapi-plugin-oidc",
-  "version": "1.5.2",
+  "version": "1.5.3",
   "description": "A Strapi plugin that provides OpenID Connect (OIDC) authentication functionality for the Strapi Admin Panel.",
   "strapi": {
     "displayName": "OIDC Plugin",