1

Node.js keycloak-nodejs-connect adapter (version 4.3) is used in an application gateway for protecting microservices' endpoints according to docs:

var session = require('express-session');
var Keycloak = require('keycloak-connect');

var memoryStore = new session.MemoryStore();
var keycloak = new Keycloak({ store: memoryStore });

However, after a user log in/ log out flow, connect.sid cookie originating from express-session is still stored inside browser. It causes unexpected issues if another user logs in via the same browser afterwards.

How to clear connect.sid express-session cookie correctly?

Overriding adapter's session store code by adding response.clearCookie('connect.sid', { path: '/' }); to unstore function helped. However, it seems too complicated: 

    var SessionStore = require('keycloak-connect/stores/session-store');

    let store = (grant) => {
        return (request, response) => {
          request.session[SessionStore.TOKEN_KEY] = grant.__raw;
        };
    };

    let unstore = (request, response) => {
        delete request.session[SessionStore.TOKEN_KEY];
        response.clearCookie('connect.sid', { path: '/' });
    };

    SessionStore.prototype.wrap = (grant) => {
        if (grant) {
          grant.store = store(grant);
          grant.unstore = unstore;
        }
    };

Does some keycloak adapter or express-session configuration achieve the goal better?

rok
  • 9,403
  • 17
  • 70
  • 126
  • What kind of problems do you get? The fact that the cookie is still stored in the browser after /logoff should not be a big deal. If the Server has deleted the session for that cookie. On a next request, Keycloak should send your new user to a login page and then refesh the cookie. – Roman Mik Feb 20 '20 at 18:49
  • Are you using the front-end keycloak.js as well? or the whole authentication/authorization is done by the back-end only? – Roman Mik Feb 20 '20 at 18:52
  • the whole authentication/authorization is done by the back-end only, ui relies on backend – rok Feb 24 '20 at 15:09
  • The problem is that cookie `'connect.sid'` is not deleted after logout – rok Feb 24 '20 at 15:09
  • what happens when a request comes in with an old cookie? The logic responsible for checking in against the session should flag it as a wrong cookie and a new login process should start. – Roman Mik Feb 24 '20 at 18:57
  • Regarding the delete cookie: There's no effective way to do that. The browser chooses when to delete it, you can "suggest it" by setting the expiration information. https://stackoverflow.com/questions/27978868/destroy-cookie-nodejs – Roman Mik Feb 24 '20 at 18:58
  • Also, connect.sid could be a cookie session store. I don't remember seeing this cookie in my work with keycloak. A quick search points towards express-passport – Roman Mik Feb 24 '20 at 18:59

1 Answers1

0

Your thinking is correct, I'm not sure overriding Keycloak's unstore method is the best way to go about it though (might mess things up if you upgrade Keycloak, or if you want to use unstoreGrant to remove just the grant, but keep the rest of the session).

A better approach would be to create a new middleware that triggers on your logout route:

app.use('/logout', (req, res, next) => {
  req.session.destroy();
  res.clearCookie('connect.sid', { path: '/' });
  res.redirect(keycloak.logoutUrl()); // optional
});
markmanx
  • 11
  • 1