Keycloak logout not working

[buff]

Steps to reproduce

Configure keycloak auth
Call composable to clear session

• const { clear } = useUserSession();
• await clear();
• await navigateTo('/login');
  Log back in
  Expectation
  Session hook should fire
  sessionHooks.hook('clear'
  User cookie should be cleared

[mpgalaxy]

Hi, correct, this is the case in many third party libs, I'm afraid. I use my own logout routine doing a POST to keycloak in the callback of clear:

async function customLogout() {
  const refresh_token = session.value.refresh_token;
  await clear().then(async () => {
    const endpoint = config.public.frontendUrl;
    await $fetch(endpoint + "/customlogout", {
      method: "POST",
      body: new URLSearchParams({
        client_id: process.env.KEYCLOAK_CLIENT_ID,
        grant_type: "refresh_token",
        refresh_token: refresh_token,
        post_logout_redirect_uri: endpoint,
      }),
      headers: {
        "Content-Type": "application/x-www-form-urlencoded",
      },
    });
  });

using a nuxt proxy endpoint via route rules:

routeRules: {
    "/customlogout": {
      proxy: {
        to:
          (process.env.KEYCLOAK_SCHEME || "http") +
          "://" +
          (process.env.KEYCLOAK_HOST || "localhost") +
          ":" +
          (process.env.KEYCLOAK_PORT || "8080") +
          (process.env.IS_KEYCLOAK_QUARKUS.toLowerCase() === "true"
            ? ""
            : "/auth") +
          "/realms/" +
          (process.env.KEYCLOAK_REALM || "master") +
          "/protocol/openid-connect/logout",
      },
    },
  },

hth
Btw: @buff Did you manage to get token refresh working ? I couldn't get the refresh_token on server side...

[buff]

@mpgalaxy I ended up with the same approach... I used the keycloak admin api end point just like your example...
I am also doing something similar for the refresh_token. I am doing this on the client side... Not sure if it actually works, have not really tested it... but I refresh the token on every api call, if I calculate it has expired

if (s.token.expirationDate && dayjs().isAfter(s.token.expirationDate)) {
const refreshToken = s.token.refreshToken;
const config = useRuntimeConfig();
const kc = (config && config.oauth && config.oauth.keycloak) || {};
const tokenUrl = ${kc.serverUrl}/realms/${kc.realm}/protocol/openid-connect/token;

      // Keycloak token refresh expects x-www-form-urlencoded form data
      const params = new URLSearchParams();
      params.append('grant_type', 'refresh_token');
      if (kc.clientId) params.append('client_id', String(kc.clientId));
      if (kc.clientSecret) params.append('client_secret', String(kc.clientSecret));
      params.append('refresh_token', String(refreshToken));

      const token_data = await $fetch(tokenUrl, {
        method: 'POST',
        headers: {
          'Content-Type': 'application/x-www-form-urlencoded',
        },
        body: params.toString(),
      });
      console.log('updatedTokens', token_data);
    }

[mpgalaxy]

I thought about that, too, but wanted to do that on server side due to security considerations.
Don't you expose the clientSecret firing the request on client side ? You could see that request in the network history of your browser's dev tools.
@atinux : could we open the discussions section for this project ? maybe we can share more knowledge there than spamming issues with btws ;)

[buff]

@mpgalaxy Yes... the plan is to move it to the server like the logout code... It has a TBD... good thing you reminded me ;-)