Skip to content

feat(oidc): support post_logout_redirect_uri in logout #9608

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
zhaohuabing wants to merge 2 commits into
base: main
Choose a base branch
from
Draft

feat(oidc): support post_logout_redirect_uri in logout #9608

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
886997e
build(deps): bump go-control-plane for oauth2 post_logout_redirect_uri
zhaohuabing Jul 29, 2026
4eac001
feat(oidc): support post_logout_redirect_uri in logout
zhaohuabing Jul 29, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
52 changes: 52 additions & 0 deletions api/v1alpha1/oidc_types.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -94,6 +94,20 @@ type OIDC struct {
// If not specified, uses a default logout path "/logout"
LogoutPath *string `json:"logoutPath,omitempty"`

// PostLogoutRedirect configures the `post_logout_redirect_uri` parameter that EG sends to the
// OIDC Provider's end session endpoint when a user accesses the logout path.
//
// This only applies when the OIDC Provider's end session endpoint is configured or discovered,
// i.e. when RP-Initiated Logout is in use. It is ignored otherwise.
//
// If not specified, Envoy sends the root of the request's host, "<scheme>://<host>/".
// Note that many OIDC Providers require the post logout redirect URI to be pre-registered for
// the client and reject the logout request otherwise. If the default value is not registered,
// set an explicit uri here, or set disabled to true to omit the parameter altogether.
//
// +optional
PostLogoutRedirect *OIDCPostLogoutRedirect `json:"postLogoutRedirect,omitempty"`

// ForwardAccessToken indicates whether the Envoy should forward the access token
// via the Authorization header Bearer scheme to the upstream.
// If not specified, defaults to false.
Expand Down Expand Up @@ -235,6 +249,44 @@ type OIDCDenyRedirectHeader struct {
StringMatch `json:",inline"`
}

// OIDCPostLogoutRedirect configures the `post_logout_redirect_uri` parameter used in OIDC
// [RP-Initiated Logout](https://openid.net/specs/openid-connect-rpinitiated-1_0.html) requests.
//
// Exactly one of uri or disabled must be set.
//
// +kubebuilder:validation:XValidation:rule="has(self.uri) != has(self.disabled)",message="exactly one of uri or disabled must be set"
type OIDCPostLogoutRedirect struct {
// URI is sent as the `post_logout_redirect_uri` parameter to the OIDC Provider's end session
// endpoint. The provider redirects the user to this URI after the logout completes, so it
// usually must be pre-registered for the client with the provider.
//
// The URI may contain the Envoy "%REQ(header)%"
// [command operator](https://www.envoyproxy.io/docs/envoy/latest/configuration/observability/access_log/usage#command-operators)
// to build the URI from the request, for example
// "%REQ(x-forwarded-proto)%://%REQ(:authority)%/loggedout". Envoy Gateway accepts only that
// operator here, since it is the only one meaningful in a URI derived from the request, and
// rejects any other so that a typo surfaces on this policy instead of being rejected by Envoy
// as an invalid configuration. A literal percent is written as "%%".
//
// The scheme must be http, https, or a "%REQ(header)%" command operator. The URI is
// percent-encoded automatically when the logout URL is built, so do not pre-encode it.
//
// +optional
// +kubebuilder:validation:MinLength=1
// +kubebuilder:validation:MaxLength=2048
URI *string `json:"uri,omitempty"`

// Disabled omits the `post_logout_redirect_uri` parameter from the logout request entirely.
// Use this when the OIDC Provider rejects unregistered post logout redirect URIs and you do
// not need the user redirected back after the logout completes. In that case the user is left
// on a page controlled by the provider.
//
// Setting this to false is equivalent to leaving postLogoutRedirect unset.
//
// +optional
Disabled *bool `json:"disabled,omitempty"`
}

// OIDCCookieNames defines the names of cookies to use in the Envoy OIDC filter.
type OIDCCookieNames struct {
// The name of the cookie used to store the AccessToken in the
Expand Down
30 changes: 30 additions & 0 deletions api/v1alpha1/zz_generated.deepcopy.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

45 changes: 45 additions & 0 deletions charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_securitypolicies.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5768,6 +5768,51 @@ spec:

If not specified, defaults to false.
type: boolean
postLogoutRedirect:
description: |-
PostLogoutRedirect configures the `post_logout_redirect_uri` parameter that EG sends to the
OIDC Provider's end session endpoint when a user accesses the logout path.

This only applies when the OIDC Provider's end session endpoint is configured or discovered,
i.e. when RP-Initiated Logout is in use. It is ignored otherwise.

If not specified, Envoy sends the root of the request's host, "<scheme>://<host>/".
Note that many OIDC Providers require the post logout redirect URI to be pre-registered for
the client and reject the logout request otherwise. If the default value is not registered,
set an explicit uri here, or set disabled to true to omit the parameter altogether.
properties:
disabled:
description: |-
Disabled omits the `post_logout_redirect_uri` parameter from the logout request entirely.
Use this when the OIDC Provider rejects unregistered post logout redirect URIs and you do
not need the user redirected back after the logout completes. In that case the user is left
on a page controlled by the provider.

Setting this to false is equivalent to leaving postLogoutRedirect unset.
type: boolean
uri:
description: |-
URI is sent as the `post_logout_redirect_uri` parameter to the OIDC Provider's end session
endpoint. The provider redirects the user to this URI after the logout completes, so it
usually must be pre-registered for the client with the provider.

The URI may contain the Envoy "%REQ(header)%"
[command operator](https://www.envoyproxy.io/docs/envoy/latest/configuration/observability/access_log/usage#command-operators)
to build the URI from the request, for example
"%REQ(x-forwarded-proto)%://%REQ(:authority)%/loggedout". Envoy Gateway accepts only that
operator here, since it is the only one meaningful in a URI derived from the request, and
rejects any other so that a typo surfaces on this policy instead of being rejected by Envoy
as an invalid configuration. A literal percent is written as "%%".

The scheme must be http, https, or a "%REQ(header)%" command operator. The URI is
percent-encoded automatically when the logout URL is built, so do not pre-encode it.
maxLength: 2048
minLength: 1
type: string
type: object
x-kubernetes-validations:
- message: exactly one of uri or disabled must be set
rule: has(self.uri) != has(self.disabled)
provider:
description: The OIDC Provider configuration.
properties:
Expand Down
45 changes: 45 additions & 0 deletions charts/gateway-helm/charts/crds/crds/generated/gateway.envoyproxy.io_securitypolicies.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5767,6 +5767,51 @@ spec:

If not specified, defaults to false.
type: boolean
postLogoutRedirect:
description: |-
PostLogoutRedirect configures the `post_logout_redirect_uri` parameter that EG sends to the
OIDC Provider's end session endpoint when a user accesses the logout path.

This only applies when the OIDC Provider's end session endpoint is configured or discovered,
i.e. when RP-Initiated Logout is in use. It is ignored otherwise.

If not specified, Envoy sends the root of the request's host, "<scheme>://<host>/".
Note that many OIDC Providers require the post logout redirect URI to be pre-registered for
the client and reject the logout request otherwise. If the default value is not registered,
set an explicit uri here, or set disabled to true to omit the parameter altogether.
properties:
disabled:
description: |-
Disabled omits the `post_logout_redirect_uri` parameter from the logout request entirely.
Use this when the OIDC Provider rejects unregistered post logout redirect URIs and you do
not need the user redirected back after the logout completes. In that case the user is left
on a page controlled by the provider.

Setting this to false is equivalent to leaving postLogoutRedirect unset.
type: boolean
uri:
description: |-
URI is sent as the `post_logout_redirect_uri` parameter to the OIDC Provider's end session
endpoint. The provider redirects the user to this URI after the logout completes, so it
usually must be pre-registered for the client with the provider.

The URI may contain the Envoy "%REQ(header)%"
[command operator](https://www.envoyproxy.io/docs/envoy/latest/configuration/observability/access_log/usage#command-operators)
to build the URI from the request, for example
"%REQ(x-forwarded-proto)%://%REQ(:authority)%/loggedout". Envoy Gateway accepts only that
operator here, since it is the only one meaningful in a URI derived from the request, and
rejects any other so that a typo surfaces on this policy instead of being rejected by Envoy
as an invalid configuration. A literal percent is written as "%%".

The scheme must be http, https, or a "%REQ(header)%" command operator. The URI is
percent-encoded automatically when the logout URL is built, so do not pre-encode it.
maxLength: 2048
minLength: 1
type: string
type: object
x-kubernetes-validations:
- message: exactly one of uri or disabled must be set
rule: has(self.uri) != has(self.disabled)
provider:
description: The OIDC Provider configuration.
properties:
Expand Down
8 changes: 4 additions & 4 deletions examples/extension-server/go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,8 +4,8 @@ go 1.26.5

require (
github.com/envoyproxy/gateway v1.3.1
github.com/envoyproxy/go-control-plane v0.14.1-0.20260627225610-70ff85c381ff
github.com/envoyproxy/go-control-plane/envoy v1.37.1-0.20260627225610-70ff85c381ff
github.com/envoyproxy/go-control-plane v0.14.1-0.20260729034317-78e59f151126
github.com/envoyproxy/go-control-plane/envoy v1.37.1-0.20260729034317-78e59f151126
github.com/urfave/cli/v2 v2.27.7
google.golang.org/grpc v1.82.1
google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af
Expand Down Expand Up @@ -59,8 +59,8 @@ require (
golang.org/x/sys v0.47.0 // indirect
golang.org/x/text v0.40.0 // indirect
golang.org/x/tools v0.47.0 // indirect
google.golang.org/genproto/googleapis/api v0.0.0-20260706201446-f0a921348800 // indirect
google.golang.org/genproto/googleapis/rpc v0.0.0-20260706201446-f0a921348800 // indirect
google.golang.org/genproto/googleapis/api v0.0.0-20260720211330-0afa2a65878a // indirect
google.golang.org/genproto/googleapis/rpc v0.0.0-20260720211330-0afa2a65878a // indirect
gopkg.in/inf.v0 v0.9.1 // indirect
gopkg.in/yaml.v2 v2.4.0 // indirect
gopkg.in/yaml.v3 v3.0.1 // indirect
Expand Down
20 changes: 10 additions & 10 deletions examples/extension-server/go.sum
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,10 +21,10 @@ github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSs
github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM=
github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
github.com/envoyproxy/go-control-plane v0.14.1-0.20260627225610-70ff85c381ff h1:tDxhbFOO5qR1vgixjuOI5RBxASCvac4Ki3EgC4dBDPI=
github.com/envoyproxy/go-control-plane v0.14.1-0.20260627225610-70ff85c381ff/go.mod h1:H3lDamtuGa0Y80VmchcmbutXMYNPDr0j+JrLlsgyEyo=
github.com/envoyproxy/go-control-plane/envoy v1.37.1-0.20260627225610-70ff85c381ff h1:stwP9x94QfAFs+RF+YFkSrSuTxBuVrj6Sv+PJXJkXzo=
github.com/envoyproxy/go-control-plane/envoy v1.37.1-0.20260627225610-70ff85c381ff/go.mod h1:RgJXVdNtBhId0AeGnDEqPRSejRMoz//JumYvSTcJTvM=
github.com/envoyproxy/go-control-plane v0.14.1-0.20260729034317-78e59f151126 h1:YBp3WmY3V1e8QDWIRgGbtCRWoaVzMV84pcj4Ji1sGOc=
github.com/envoyproxy/go-control-plane v0.14.1-0.20260729034317-78e59f151126/go.mod h1:rcDQvjX9fwNQvh7l9pxwfGBufBWU6xQ0zK5mcsH8/Lg=
github.com/envoyproxy/go-control-plane/envoy v1.37.1-0.20260729034317-78e59f151126 h1:Q2dTxj798lXRQdDUf89aMqzRc+JFKBuRugTgQJSA7Nc=
github.com/envoyproxy/go-control-plane/envoy v1.37.1-0.20260729034317-78e59f151126/go.mod h1:rYoRI6N8FcjZVmmeKqH8/ykAhfro9Bg8+of2IpBseyQ=
github.com/envoyproxy/protoc-gen-validate v1.3.3 h1:MVQghNeW+LZcmXe7SY1V36Z+WFMDjpqGAGacLe2T0ds=
github.com/envoyproxy/protoc-gen-validate v1.3.3/go.mod h1:TsndJ/ngyIdQRhMcVVGDDHINPLWB7C82oDArY51KfB0=
github.com/fatih/color v1.19.0 h1:Zp3PiM21/9Ld6FzSKyL5c/BULoe/ONr9KlbYVOfG8+w=
Expand Down Expand Up @@ -177,8 +177,8 @@ go.opentelemetry.io/otel/sdk/metric v1.44.0 h1:3LlKgI+VjbVsjNRFZJZAJ30WjXC5VkNRk
go.opentelemetry.io/otel/sdk/metric v1.44.0/go.mod h1:5B5pMARnXxKhltooO4xUuCBorl65a4EpnTalObqOigA=
go.opentelemetry.io/otel/trace v1.44.0 h1:jxF5CsGYCe74MCRx2X4g7WsY/VBKRqqpNvXlX/6gtIk=
go.opentelemetry.io/otel/trace v1.44.0/go.mod h1:oLl1jrMQAVo6v3GAggN+1VH9VIz9iUSvW53sW1Q8PIE=
go.opentelemetry.io/proto/otlp v1.10.0 h1:IQRWgT5srOCYfiWnpqUYz9CVmbO8bFmKcwYxpuCSL2g=
go.opentelemetry.io/proto/otlp v1.10.0/go.mod h1:/CV4QoCR/S9yaPj8utp3lvQPoqMtxXdzn7ozvvozVqk=
go.opentelemetry.io/proto/otlp v1.11.0 h1:5rrYs0Ykyj50sdU/JU0x8etU+LubXWb+gED6TbEdMIk=
go.opentelemetry.io/proto/otlp v1.11.0/go.mod h1:SmVizdCOAm3XBtG1g1NnOdhW6jtddT72hLMhv8VwA8E=
go.yaml.in/yaml/v2 v2.4.4 h1:tuyd0P+2Ont/d6e2rl3be67goVK4R6deVxCUX5vyPaQ=
go.yaml.in/yaml/v2 v2.4.4/go.mod h1:gMZqIpDtDqOfM0uNfy0SkpRhvUryYH0Z6wdMYcacYXQ=
go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
Expand Down Expand Up @@ -209,10 +209,10 @@ golang.org/x/tools/go/packages/packagestest v0.1.1-deprecated h1:1h2MnaIAIXISqTF
golang.org/x/tools/go/packages/packagestest v0.1.1-deprecated/go.mod h1:RVAQXBGNv1ib0J382/DPCRS/BPnsGebyM1Gj5VSDpG8=
gonum.org/v1/gonum v0.17.0 h1:VbpOemQlsSMrYmn7T2OUvQ4dqxQXU+ouZFQsZOx50z4=
gonum.org/v1/gonum v0.17.0/go.mod h1:El3tOrEuMpv2UdMrbNlKEh9vd86bmQ6vqIcDwxEOc1E=
google.golang.org/genproto/googleapis/api v0.0.0-20260706201446-f0a921348800 h1:admdQBe8jR3VWhBsUrAOaF2Qw6K/+p5pSm1GN8+6Fw4=
google.golang.org/genproto/googleapis/api v0.0.0-20260706201446-f0a921348800/go.mod h1:FPk7EXUKMtImne7AmknoYjT4QXqKIzzRbeQIXzLk6fQ=
google.golang.org/genproto/googleapis/rpc v0.0.0-20260706201446-f0a921348800 h1:qEHAMpSaUhtD0p3NbEEI83HwNGFxEwaSJ1G9PLnCBZE=
google.golang.org/genproto/googleapis/rpc v0.0.0-20260706201446-f0a921348800/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=
google.golang.org/genproto/googleapis/api v0.0.0-20260720211330-0afa2a65878a h1:97PfJ4tCxY5C7NzzgGqQEMZmXbISdvSArNNEOoUGKBg=
google.golang.org/genproto/googleapis/api v0.0.0-20260720211330-0afa2a65878a/go.mod h1:1brfde68Npq6+WA75c1EHWPijZEG1kMus61ygPZfn4A=
google.golang.org/genproto/googleapis/rpc v0.0.0-20260720211330-0afa2a65878a h1:qI/YMH1ep2qQtqcp00gMQyoU7mjvbhg88GJKCvfoLj0=
google.golang.org/genproto/googleapis/rpc v0.0.0-20260720211330-0afa2a65878a/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=
google.golang.org/grpc v1.82.1 h1:NnAxzGRA0677vCa4BUkOAnO5+FfQqVl9iUXeD0IqcGE=
google.golang.org/grpc v1.82.1/go.mod h1:yzTZ1TB1Z3SG+LIYaI+WiE8D5+PZ3ArnrSp8zF3+/ZA=
google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af h1:+5/Sw3GsDNlEmu7TfklWKPdQ0Ykja5VEmq2i817+jbI=
Expand Down
14 changes: 7 additions & 7 deletions go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,10 +12,10 @@ require (
github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc
github.com/docker/cli v29.6.2+incompatible
github.com/dominikbraun/graph v0.23.0
github.com/envoyproxy/go-control-plane v0.14.1-0.20260627225610-70ff85c381ff
github.com/envoyproxy/go-control-plane/contrib v1.36.1-0.20260627225610-70ff85c381ff
github.com/envoyproxy/go-control-plane/envoy v1.37.1-0.20260627225610-70ff85c381ff
github.com/envoyproxy/go-control-plane/ratelimit v0.1.1-0.20260627225610-70ff85c381ff
github.com/envoyproxy/go-control-plane v0.14.1-0.20260729034317-78e59f151126
github.com/envoyproxy/go-control-plane/contrib v1.36.1-0.20260729034317-78e59f151126
github.com/envoyproxy/go-control-plane/envoy v1.37.1-0.20260729034317-78e59f151126
github.com/envoyproxy/go-control-plane/ratelimit v0.1.1-0.20260729034317-78e59f151126
github.com/envoyproxy/ratelimit v1.4.1-0.20260122083618-3fb702589d36
github.com/evanphx/json-patch v5.9.11+incompatible
github.com/evanphx/json-patch/v5 v5.9.11
Expand Down Expand Up @@ -53,11 +53,11 @@ require (
go.opentelemetry.io/otel/sdk v1.44.0
go.opentelemetry.io/otel/sdk/metric v1.44.0
go.opentelemetry.io/otel/trace v1.44.0
go.opentelemetry.io/proto/otlp v1.10.0
go.opentelemetry.io/proto/otlp v1.11.0
go.uber.org/zap v1.28.0
golang.org/x/sync v0.22.0
gomodules.xyz/jsonpatch/v2 v2.5.0
google.golang.org/genproto/googleapis/rpc v0.0.0-20260706201446-f0a921348800
google.golang.org/genproto/googleapis/rpc v0.0.0-20260720211330-0afa2a65878a
google.golang.org/grpc v1.82.1
google.golang.org/grpc/security/advancedtls v1.0.0
google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af
Expand Down Expand Up @@ -267,7 +267,7 @@ require (
golang.org/x/text v0.40.0 // indirect
golang.org/x/time v0.15.0 // indirect
golang.org/x/tools v0.47.0 // indirect
google.golang.org/genproto/googleapis/api v0.0.0-20260706201446-f0a921348800 // indirect
google.golang.org/genproto/googleapis/api v0.0.0-20260720211330-0afa2a65878a // indirect
gopkg.in/evanphx/json-patch.v4 v4.13.0 // indirect
gopkg.in/inf.v0 v0.9.1 // indirect
gopkg.in/yaml.v2 v2.4.0 // indirect
Expand Down
Loading
Loading