[SDK-3887] Always honor auth0Logout config

[adamjmcgrath]

See auth0/express-openid-connect#447

Description

The OIDC RP Initiated Logout endpoint is incompatible with Auth0's proprietary logout. Make sure this SDK does not use it if auth0Logout is configured and an end_session_endpoint is Discovered in the OIDC Discovery document.

Testing

If auth0Logout is true -> use v2/logout regardless of discovery
If auth0Logout is false -> use discovered endpoint or nothing
If auth0Logout is not set -> use v2/logout regardless of discovery (this is different from express as this is an auth0 SDK)

Checklist

• I have added documentation for new/changed functionality in this PR or in auth0.com/docs
• All active GitHub checks for tests, formatting, and security are passing
• The correct base branch is being used, if not the default branch

[vercel]

The latest updates on your projects. Learn more about Vercel for Git ↗︎

1 Ignored Deployment

Name	Status	Preview	Comments	Updated
nextjs-auth0	⬜️ Ignored (Inspect)			Mar 10, 2023 at 4:08PM (UTC)

[blakeplumb]

@adamjmcgrath is there a way to set auth0Logout to false via an environment variable? We don't use the base config, and removing the default as false broke our logouts

[adamjmcgrath]

Hi @blakeplumb - how did auth0Logout default break your logout, are you using this with a different identity provider than auth0?

[KentDi801]

@adamjmcgrath - I work with Blake. We are currently using @auth0/nextjs-auth0 because it gives us great support for doing OAuth2 auth in NextJS but we are using Okta as our Identity provider. When we go to logout it passes oauth2/default/v2/logout?returnTo=http in the url and we get a 404 error because our tenants to not support v2 for logout.

[adamjmcgrath]

Hi @KentDi801 - we should have an environment variable for auth0logout, so you can set it to false. Will add a PR for that shortly.

[adamjmcgrath]

@KentDi801 @blakeplumb the AUTH0_LOGOUT environment variable is available in https://github.com/auth0/nextjs-auth0/releases/tag/v2.3.0

[KentDi801]

@adamjmcgrath thank you for the quick response on this.