@@ -365,3 +365,190 @@ describe("when logout is invoked and discovery contains ping_end_session_endpoin
365365 end )
366366end )
367367
368+ describe (" when revoke_tokens_on_logout is enabled and a valid revocation endpoint is supplied with auth method client_secret_basic" function ()
369+ test_support .start_server ({
370+ oidc_opts = {
371+ revoke_tokens_on_logout = true ,
372+ discovery = {
373+ revocation_endpoint = " http://127.0.0.1/revocation"
374+ token_endpoint_auth_methods_supported = { " foo" " client_secret_post" " client_secret_basic"
375+ },
376+ token_endpoint_auth_method = " client_secret_basic"
377+ }
378+ })
379+ teardown (test_support .stop_server )
380+ local _ , _ , cookie = test_support .login ()
381+ local _ , status , headers = http .request ({
382+ url = " http://127.0.0.1/default/logout"
383+ headers = { cookie = cookie },
384+ redirect = false
385+ })
386+ it (" the response contains a default HTML-page" function ()
387+ assert .are .equals (200 , status )
388+ assert .are .equals (" text/html" headers [" content-type"
389+ end )
390+
391+ it (" the session cookie has been revoked" function ()
392+ assert .truthy (string.match (headers [" set-cookie"
393+ " session=; Expires=Thu, 01 Jan 1970 00:00:01 GMT.*"
394+ end )
395+
396+ it (" authorization credentials have not been passed on as post parameters to the revocation endpoint" function ()
397+ assert .is_not .error_log_contains (" Received revocation request: .*client_id"
398+ end )
399+
400+ it (" authorization header has been passed on to the revocation endpoint" function ()
401+ assert .error_log_contains (" revocation authorization header: Basic .+"
402+ end )
403+
404+ it (" token to be revoked has been passed on as a post parameter to the revocation endpoint" function ()
405+ assert .error_log_contains (" Received revocation request: .*token=.+"
406+ end )
407+
408+ it (" debug messages concerning successful revocation have been logged" function ()
409+ assert .error_log_contains (" revocation of refresh_token successful"
410+ assert .error_log_contains (" revocation of access_token successful"
411+ end )
412+ end )
413+
414+ describe (" when revoke_tokens_on_logout is enabled and a valid revocation endpoint is supplied with auth method client_secret_post" function ()
415+ test_support .start_server ({
416+ oidc_opts = {
417+ revoke_tokens_on_logout = true ,
418+ discovery = {
419+ revocation_endpoint = " http://127.0.0.1/revocation"
420+ token_endpoint_auth_methods_supported = { " foo" " client_secret_basic" " client_secret_post"
421+ },
422+ token_endpoint_auth_method = " client_secret_post"
423+ }
424+ })
425+ teardown (test_support .stop_server )
426+ local _ , _ , cookie = test_support .login ()
427+ local _ , status , headers = http .request ({
428+ url = " http://127.0.0.1/default/logout"
429+ headers = { cookie = cookie },
430+ redirect = false
431+ })
432+ it (" the response contains a default HTML-page" function ()
433+ assert .are .equals (200 , status )
434+ assert .are .equals (" text/html" headers [" content-type"
435+ end )
436+
437+ it (" the session cookie has been revoked" function ()
438+ assert .truthy (string.match (headers [" set-cookie"
439+ " session=; Expires=Thu, 01 Jan 1970 00:00:01 GMT.*"
440+ end )
441+
442+ it (" authorization header has not been passed on to the revocation endpoint" function ()
443+ assert .is_not .error_log_contains (" revocation authorization header: Basic"
444+ end )
445+
446+ it (" authorization credentials have been passed on as post parameters to the revocation endpoint" function ()
447+ assert .error_log_contains (" Received revocation request: .*client_id=.+"
448+ end )
449+
450+ it (" token to be revoked has been passed on as a post parameter to the revocation endpoint" function ()
451+ assert .error_log_contains (" Received revocation request: .*token=.+"
452+ end )
453+
454+ it (" debug messages concerning successful revocation have been logged" function ()
455+ assert .error_log_contains (" revocation of refresh_token successful"
456+ assert .error_log_contains (" revocation of access_token successful"
457+ end )
458+ end )
459+
460+ describe (" when revoke_tokens_on_logout is enabled and an invalid revocation endpoint is supplied" function ()
461+ test_support .start_server ({
462+ oidc_opts = {
463+ revoke_tokens_on_logout = true ,
464+ discovery = {
465+ revocation_endpoint = " http://127.0.0.1/invalid_revocation"
466+ }
467+ }
468+ })
469+ teardown (test_support .stop_server )
470+ local _ , _ , cookie = test_support .login ()
471+ local _ , status , headers = http .request ({
472+ url = " http://127.0.0.1/default/logout"
473+ headers = { cookie = cookie },
474+ redirect = false
475+ })
476+ it (" the response still contains a default HTML-page" function ()
477+ assert .are .equals (200 , status )
478+ assert .are .equals (" text/html" headers [" content-type"
479+ end )
480+
481+ it (" the session cookie still has been revoked" function ()
482+ assert .truthy (string.match (headers [" set-cookie"
483+ " session=; Expires=Thu, 01 Jan 1970 00:00:01 GMT.*"
484+ end )
485+
486+ it (" error messages concerning unseccussful revocation have been logged" function ()
487+ assert .error_log_contains (" revocation of refresh_token unsuccessful"
488+ assert .error_log_contains (" revocation of access_token unsuccessful"
489+ end )
490+ end )
491+
492+ describe (" when revoke_tokens_on_logout is enabled but no revocation endpoint is supplied" function ()
493+ test_support .start_server ({
494+ oidc_opts = {
495+ revoke_tokens_on_logout = true ,
496+ discovery = {
497+ revocation_endpoint = nil
498+ }
499+ }
500+ })
501+ teardown (test_support .stop_server )
502+ local _ , _ , cookie = test_support .login ()
503+ local _ , status , headers = http .request ({
504+ url = " http://127.0.0.1/default/logout"
505+ headers = { cookie = cookie },
506+ redirect = false
507+ })
508+ it (" the response still contains a default HTML-page" function ()
509+ assert .are .equals (200 , status )
510+ assert .are .equals (" text/html" headers [" content-type"
511+ end )
512+
513+ it (" the session cookie still has been revoked" function ()
514+ assert .truthy (string.match (headers [" set-cookie"
515+ " session=; Expires=Thu, 01 Jan 1970 00:00:01 GMT.*"
516+ end )
517+
518+ it (" debug messages concerning unseccussful revocation have been logged" function ()
519+ assert .error_log_contains (" no revocation endpoint supplied. unable to revoke refresh_token"
520+ assert .error_log_contains (" no revocation endpoint supplied. unable to revoke access_token"
521+ end )
522+ end )
523+
524+ describe (" when revoke_tokens_on_logout is not defined and a revocation_endpoint is given" function ()
525+ test_support .start_server ({
526+ oidc_opts = {
527+ revoke_tokens_on_logout = nil ,
528+ discovery = {
529+ revocation_endpoint = " http://127.0.0.1/revocation"
530+ }
531+ }
532+ })
533+ teardown (test_support .stop_server )
534+ local _ , _ , cookie = test_support .login ()
535+ local _ , status , headers = http .request ({
536+ url = " http://127.0.0.1/default/logout"
537+ headers = { cookie = cookie },
538+ redirect = false
539+ })
540+ it (" the response still contains a default HTML-page" function ()
541+ assert .are .equals (200 , status )
542+ assert .are .equals (" text/html" headers [" content-type"
543+ end )
544+
545+ it (" the session cookie still has been revoked" function ()
546+ assert .truthy (string.match (headers [" set-cookie"
547+ " session=; Expires=Thu, 01 Jan 1970 00:00:01 GMT.*"
548+ end )
549+
550+ it (" no messages concerning revocation have been logged" function ()
551+ assert .is_not .error_log_contains (" revocation"
552+ assert .is_not .error_log_contains (" revoke"
553+ end )
554+ end )
0 commit comments