From 5019cd13fe4b943adae0ca24d99d80992ab7f124 Mon Sep 17 00:00:00 2001 From: Leo Vasanko Date: Tue, 17 Feb 2026 00:07:26 +0000 Subject: [PATCH] Fix again, didn't work --- paskia/fastapi/oid.py | 13 +++++-------- 1 file changed, 5 insertions(+), 8 deletions(-) diff --git a/paskia/fastapi/oid.py b/paskia/fastapi/oid.py index f59667f..ba1304d 100644 --- a/paskia/fastapi/oid.py +++ b/paskia/fastapi/oid.py @@ -466,22 +466,19 @@ async def userinfo( @app.post("/backchannel-logout") async def backchannel_logout( request: Request, - logout_token: str | None = Body(None, embed=False), + logout_token: str = Form(...), ): """OIDC Back-Channel Logout endpoint. Receives a logout_token JWT from the RP and invalidates the session. The logout_token must contain either 'sid' (session ID) or 'sub' (user ID). + Per OIDC Back-Channel Logout 1.0: uses application/x-www-form-urlencoded. """ - # Parse form data + # Validate content type content_type = request.headers.get("content-type", "") - if "application/x-www-form-urlencoded" in content_type: - form = await request.form() - logout_token = form.get("logout_token", logout_token) - - if not logout_token: + if "application/x-www-form-urlencoded" not in content_type: return JSONResponse( - {"error": "invalid_request", "error_description": "Missing logout_token"}, + {"error": "invalid_request", "error_description": "Content-Type must be application/x-www-form-urlencoded"}, status_code=400, )