Fix revoke access token error handling (#67)

- [x] Do not stop flow if revoke fails. 
- [x] Properly handle/log error

## Motivation and Context

<!--- Why is this change required? What problem does it solve? -->
<!--- If it fixes an open issue, please link to the issue here. -->

## How Has This Been Tested?

<!--- Please describe in detail how you tested your changes. -->
<!--- Include details of your testing environment, and the tests you ran
to -->
<!--- see how your change affects other areas of the code, etc. -->

## Checklist:

<!--- Go over all the following points, and put an `x` in all the boxes
that apply. -->
<!--- If you're unsure about any of these, don't hesitate to ask. We're
here to help! -->

- [ ] My change requires a change to the documentation or CHANGELOG.
- [ ] I have updated the documentation/CHANGELOG accordingly.
- [ ] I have created a feature (non-master) branch for my PR.
This commit is contained in:
Anderson Valério 2025-06-02 16:58:00 -03:00 committed by GitHub
commit 5a1d721a60
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
2 changed files with 11 additions and 11 deletions

View File

@ -815,16 +815,12 @@ func (p *OAuthProxy) backendLogout(rw http.ResponseWriter, req *http.Request, si
p.picsAuditClient.CreateSuccessfulLogoutAuditEntry(session, req.RequestURI, req.Header.Get("edisp-org-id"))
} else {
if providerData.BackendRevokeAccessTokenURL != "" {
resp, err := PicsRevokeAcessToken(providerData.BackendRevokeAccessTokenURL, session.AccessToken, providerData.ClientID, providerData.ClientSecret)
err := PicsRevokeAccessToken(providerData.BackendRevokeAccessTokenURL, session.AccessToken, providerData.ClientID, providerData.ClientSecret)
if err != nil {
logger.Errorf("error while calling backend revoke access token: %v", err)
return
} else {
p.picsAuditClient.CreateSuccessfulRevokeAccessTokenAuditEntry(session, req.RequestURI, req.Header.Get("edisp-org-id"))
}
if resp.StatusCode() != 200 {
logger.Errorf("error while calling backend revoke acess token url, returned error code %v", resp.StatusCode())
}
p.picsAuditClient.CreateSuccessfulRevokeAccessTokenAuditEntry(session, req.RequestURI, req.Header.Get("edisp-org-id"))
}
if providerData.BackendLogoutURL == "" {

View File

@ -35,11 +35,11 @@ func PicsSignOutAllSessions(backendLogoutAllSessionsURL string, introspectClaims
return resp, err
}
func PicsRevokeAcessToken(backendRevokeURL string, accessToken string, clientID string, clientSecret string) (resp requests.Result, err error) {
func PicsRevokeAccessToken(backendRevokeURL string, accessToken string, clientID string, clientSecret string) (err error) {
authHeader := "Basic " + base64.StdEncoding.EncodeToString([]byte(clientID+":"+clientSecret))
body := "token=" + accessToken
resp = requests.New(backendRevokeURL).
resp := requests.New(backendRevokeURL).
WithMethod("POST").
SetHeader("Authorization", authHeader).
SetHeader("api-version", "2").
@ -49,10 +49,14 @@ func PicsRevokeAcessToken(backendRevokeURL string, accessToken string, clientID
Do()
if resp.Error() != nil {
return nil, fmt.Errorf("error revoking access token: %v", resp.Error())
return fmt.Errorf("error revoking access token: %v", resp.Error())
}
return resp, nil
if resp.StatusCode() != 200 {
return fmt.Errorf("error revoking access token: status code %d, error: %v", resp.StatusCode(), resp.Error())
}
return nil
}
func getUserID(introspectClaims string) (string, error) {