mirrors/keycloak
1
0
Fork 0
mirror of https://github.com/keycloak/keycloak.git synced 2026-01-25 16:42:34 +00:00
Code Issues Packages Projects Releases Wiki Activity

Prevent multiple logout confirmation actions

Browse Source 
closes #32435

Signed-off-by: mposolda <mposolda@gmail.com>
This commit is contained in:
mposolda
2024-10-03 12:20:57 +02:00
committed by Marek Posolda
parent 13111daceb
commit c8ca0462a4
2 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
services/src/main/java/org/keycloak/protocol/oidc/endpoints/LogoutEndpoint.java
View File

@@ -339,7 +339,7 @@ public class LogoutEndpoint {
SessionCodeChecks checks = new LogoutSessionCodeChecks(realm, session.getContext().getUri(), request, clientConnection, session, event, code, clientId, tabId);
checks.initialVerify();
if (!checks.verifyActiveAndValidAction(AuthenticationSessionModel.Action.LOGGING_OUT.name(), ClientSessionCode.ActionType.USER) || !checks.isActionRequest() || !formData.containsKey("confirmLogout")) {
if (!checks.verifyActiveAndValidAction(AuthenticationSessionModel.Action.LOGGING_OUT.name(), ClientSessionCode.ActionType.USER) || !checks.isActionRequest()) {
AuthenticationSessionModel logoutSession = checks.getAuthenticationSession();
String errorMessage = "Failed verification during logout.";
logger.debugf( "%s logoutSessionId=%s, clientId=%s, tabId=%s",

2
themes/src/main/resources/theme/base/login/logout-confirm.ftl
View File

@@ -6,7 +6,7 @@
<div id="kc-logout-confirm" class="content-area">
<p class="instruction">${msg("logoutConfirmHeader")}</p>
<form class="form-actions" action="${url.logoutConfirmAction}" method="POST">
<form class="form-actions" action="${url.logoutConfirmAction}" onsubmit="confirmLogout.disabled = true; return true;" method="POST">
<input type="hidden" name="session_code" value="${logoutConfirm.code}">
<div class="${properties.kcFormGroupClass!}">
<div id="kc-form-options">