gaoxiaopei
/
monitor-ai
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

fix: logout redirect uses OIDC_REDIRECT_URI instead of request headers (open redirect fix)

This commit is contained in:
aiyimickey 2026-07-07 17:24:49 +08:00
parent 67e8979362
commit b3b10cb162
1 changed files with 12 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
src/app/api/auth/logout/route.ts
View File

@ -1,14 +1,18 @@
// GET + POST /api/auth/logout — 退出登录（清除 cookie + 302 跳转 /login）
import { NextResponse, type NextRequest } from 'next/server'
import { NextResponse } from 'next/server'
const cookieDomain = process.env.COOKIE_DOMAIN || '.tlyq.ai'
/** 从 OIDC_REDIRECT_URI 提取 site URL（不可信请求头，见 LESSONS-LEARNED #51） */
function getSiteUrl(): string {
const redirectUri = process.env.OIDC_REDIRECT_URI || ''
try { const u = new URL(redirectUri); return `${u.protocol}//${u.host}` } catch { /* fallthrough */ }
return process.env.NEXT_PUBLIC_SITE_URL || 'https://monitor.tlyq.ai'
}
/** 清除 tlyq_session + session cookie → 302 跳转 /login */
function logoutResponse(request: NextRequest): NextResponse {
const host = request.headers.get('x-forwarded-host') || request.headers.get('host') || 'localhost'
const proto = request.headers.get('x-forwarded-proto') || 'https'
const baseUrl = `${proto}://${host}`
const response = NextResponse.redirect(new URL('/login', baseUrl))
function logoutResponse(): NextResponse {
const response = NextResponse.redirect(new URL('/login', getSiteUrl()))
response.cookies.set('tlyq_session', '', {
httpOnly: true, secure: process.env.NODE_ENV === 'production',
sameSite: 'lax', domain: cookieDomain, path: '/', maxAge: 0,
@ -17,5 +21,5 @@ function logoutResponse(request: NextRequest): NextResponse {
return response
}
export async function GET(request: NextRequest) { return logoutResponse(request) }
export async function POST(request: NextRequest) { return logoutResponse(request) }
export async function GET() { return logoutResponse() }
export async function POST() { return logoutResponse() }