[cpp-sp] branch main updated: Redesign logout response handling.

[Codeberg]

This is an automated email from the git hooks/post-receive script.

codeberg pushed a commit to branch main
in repository cpp-sp.

View the commit online:
https://codeberg.org/Shibboleth/cpp-sp/commit/13a60865f52d7df6aa598b5f36c93c8beace54b5

The following commit(s) were added to refs/heads/main by this push:
     new 13a60865 Redesign logout response handling.
13a60865 is described below

commit 13a60865f52d7df6aa598b5f36c93c8beace54b5
Author: Scott Cantor <scott at restingparrotsoftware.com>
AuthorDate: Wed Jun 3 11:20:36 2026 -0400

    Redesign logout response handling.
---
 shibsp/handler/impl/LogoutConsumer.cpp | 28 +++++++++++++++-------------
 1 file changed, 15 insertions(+), 13 deletions(-)

diff --git a/shibsp/handler/impl/LogoutConsumer.cpp b/shibsp/handler/impl/LogoutConsumer.cpp
index 028fd6c9..a0d4b7be 100644
--- a/shibsp/handler/impl/LogoutConsumer.cpp
+++ b/shibsp/handler/impl/LogoutConsumer.cpp
@@ -221,28 +221,30 @@ pair <bool,long> LogoutConsumer::completeLogout(SPRequest& request, bool removeS
 
     DDF wrapped = output.getmember("http");
     if (wrapped.isstruct()) {
-        pair<bool,long> ret = unwrapResponse(request, wrapped, token == nullptr);
+        pair<bool,long> ret = unwrapResponse(request, output, token == nullptr);
         if (ret.first) {
             return ret;
         }
     }
 
+    // If no explicit response from Hub, pull "target" from output if available.
     const char* dest = output.getmember("target").string();
-    if (dest) {
-        // Relative URLs get promoted, absolutes get validated.
-        if (*dest == '/') {
-            string d(dest);
-            request.absolutize(d);
-            return make_pair(true, request.sendRedirect(d.c_str()));
-        } else {
-            request.limitRedirect(dest);
-            return make_pair(true, request.sendRedirect(dest));
-        }
-    }
 
     // If no target from Hub we fall back to our own determination that favors
     // the logoutURL setting over homeURL.
-    return make_pair(true, request.sendRedirect(getHomeURL(request)));
+    if (!dest) {
+        dest = getHomeURL(request);
+    }
+
+    // Relative URLs get promoted, absolutes get validated.
+    if (*dest == '/') {
+        string d(dest);
+        request.absolutize(d);
+        return make_pair(true, request.sendRedirect(d.c_str()));
+    } else {
+        request.limitRedirect(dest);
+        return make_pair(true, request.sendRedirect(dest));
+    }
 }
 
 const char* LogoutConsumer::getHomeURL(SPRequest& request) const

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.