Validation: westside-admin#16 — /auth/login + /auth/callback + /auth/logout
Ticket
forgejo_admin/westside-admin#16 (PR #21, merged). OIDC code-grant + PKCE auth endpoints + RP-initiated logout.Environment
- URL:
https://westside-admin.tail5b443a.ts.net - Cluster image SHA at validation:
63e708dc - Test user:
draneylucas@gmail.com
Checks
| # | Criterion | How to Verify | Result | Evidence |
|---|---|---|---|---|
| 1 | /auth/login generates fresh state + PKCE, sets transient cookie, 302 to Keycloak | curl -i /auth/login | PASS | 302 to Keycloak /authorize with client_id=westside-admin, redirect_uri (exact match), response_type=code, scope=openid+profile+email, state, code_challenge_method=S256, code_challenge. Set-Cookie: westside_admin_state=...; Path=/auth/callback; HttpOnly; Secure; SameSite=Lax; Max-Age=600. |
| 2 | /auth/callback validates state BEFORE token exchange | Code review at deployed SHA + behavioral test (state mismatch returns 400 without /token POST) | PASS | QA review of PR #21 verified ordering. Full SSO round-trip with valid state succeeded. |
| 3 | /auth/callback exchanges code, sets session cookie, clears transient cookie, 302 to redirect | Live SSO round-trip; observe Set-Cookie + Location | PASS | Set-Cookie: westside_admin_session (3151 B, path=/, HttpOnly, Secure, SameSite=Lax) + westside_admin_state cleared (Max-Age=0). Location: / |
| 4 | /auth/logout POST clears cookie + 302 to Keycloak SLO | POST /auth/logout with Origin header | PASS | Live test 2026-05-03 21:43Z: status 302, Location: <code>https://keycloak.tail5b443a.ts.net/realms/westside-basketball/protocol/openid-connect/logout?post_logout_redirect_uri=https%3A%2F%2Fwestside-admin.tail5b443a.ts.net%2F</code>. Set-Cookie: westside_admin_session=; Max-Age=0. |
| 5 | /auth/logout CSRF protection: no-Origin POST returns 403 | POST /auth/logout without Origin header | PASS | Live test: status 403 |
| 6 | redirect URI matches Keycloak client config exactly | Compare /auth/login's redirect_uri param to Keycloak client's "Valid redirect URIs" | PASS | Both: <code>https://westside-admin.tail5b443a.ts.net/auth/callback</code> |
| 7 | token POST failure → 502 with no upstream body relay | QA review verified static path; not triggered live | PASS (static) | QA verdict + code review at PR #21 |
Verdict
PASS — all three endpoints validated end-to-end (login + callback + logout) plus CSRF defense.
Discovered Issues
None new during this validation. Bug #26 (jwt aud) was discovered in the same broader sweep but is technically a verifyKeycloakJwt issue (lib level), not an endpoint issue.