waterWang opened a new pull request, #13999: URL: https://github.com/apache/cloudstack/pull/13999
Fixes: #13997 ### Problem `command=samlSlo` (SAML Global Log Out) responds with a 302 redirect that carries no `Set-Cookie` header clearing `JSESSIONID`/`userid`/`sessionkey`. The browser therefore keeps the session key after logout, CloudStack appears to loop during sign-out, and users have to clear the browser cache (or use an incognito window) to log in again. ### Root cause `SAML2LogoutAPIAuthenticatorCmd#authenticate` calls `resp.sendRedirect(...)`, which **commits** the response. ApiServlet's `LOGOUT_API` cleanup — the loop that echoes the received cookies back with an empty value and `Max-Age=0` (`ApiServlet` L333-340) — only runs *after* the authenticator returns. By then the 302 is already committed, so its `Set-Cookie` headers are silently dropped. ### Fix Clear the session cookies (`JSESSIONID`, `sessionkey`, `userid`, ...) on the response **before** `sendRedirect(...)` in all four redirect paths of `SAML2LogoutAPIAuthenticatorCmd`, mirroring the existing cookie-cleanup loop in `ApiServlet`. The committed 302 now instructs the browser to drop the session cookies, and the next login starts with a fresh session key. ### Testing - New unit test `testAuthenticateClearsSessionCookiesBeforeRedirect` verifies the received `JSESSIONID`/`sessionkey` cookies are cleared (`Max-Age=0`, empty value) and added to the response before the redirect. - A standalone servlet-contract simulation confirms the mechanism: cookies added *after* `sendRedirect` are dropped from the committed 302 (bug reproduced), cookies added *before* `sendRedirect` are delivered (fix verified). -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
