#501 Recovered: 400 error is thrown when performing a logout without a session
Closed: Fixed by t0xic0der. Opened by t0xic0der.

While participating in the Fedora test day of Ipsilon, I encountered an issue with a 400 error when performing logout without an active session. To reproduce:

  • Access a protected page on the SP (with no active session)
  • Log into the IdP when redirected
  • Bring up a second brower tab and directly access the IdP
  • Click "logout" on the IdP to kill the session
  • Return to the browser tab with the SP and click logout (you will need to configure the SP for logout)

The browser will be redirected to the IdP to perform SLO, but you will receive a 400 "Bad Request" page since there is no longer an active session with the IdP. We should just ignore the fact that there is no session and return to the SP.


This issue ticket was originally removed from the tracker as it clashed with the pull request.
See upstream ticket for migration details.


Metadata Update from @t0xic0der:
- Issue close_status updated to: Fixed
- Issue status updated to: Closed (was: Open)

Metadata