Come together with the global Drupal community in Rotterdam, 28 Sept – 1 Oct 2026. Sessions, contribution, connection, and Early Bird savings until 8 June.Problem/Motivation
Somehow, login out a Drupal user by accessing the logout URL (/user/logout) directly (type in the URL in the address bar in the Chrome browser) could end up loading the logout page twice in a very short period of time (less than 2 second).
It might be a Chrome bug occurring in an edge case.
See https://issues.chromium.org/issues/41276238
When logging out a Drupal user, this module will call the SimpleSAML\Auth\Simple::logout() to send a SAML logout request to IDP. once the IDP finishes the logout process on their end, it will redirect to the SP's logout endpoint, which is the SimpleSAMLphp logout endpoint in our case.
The duplicated logout page loading will interrupt the SAML logout process before the IDP has a chance to redirect to SP's logout endpoint to inform the SP to logout the user on the it's end.
Steps to reproduce
It happens to Chrome browser randomly and it seems fine if logging out a user by clicking a link rather than accessing the logout URL directly via the browser's address bar.
Once it happens, there are two GET requests to the user logout page subsequently. And the first one has a SAML request redirection and second one doesn't.
The consequence is that, the user won't be logout appropriately and the SimpleSAMLphp's session still live. If the user try to saml_login again, the user can login without requiring credentials.
Proposed resolution
Delete the SimpleSAMLphp session cookie while logging out.
| Comment | File | Size | Author |
|---|
Issue fork simplesamlphp_auth-3439861
Show commands
Start within a Git clone of the project using the version control instructions.
Or, if you do not have SSH keys set up on git.drupalcode.org:
changes
Comments
Comment #2
mingsongComment #4
mingsongDue to a bug in /tests/src/Functional/SimplesamlphpAuthTest.php line 91
https://git.drupalcode.org/issue/simplesamlphp_auth-3439861/-/blob/4.x/t...
The PHPunit test won't be passed.
Comment #5
drupalite1411 commentedHi ,
Any update on this issue?
For me it is still not removing SimpleSAMLSessionID .
Steps to replicate:
1.Override session.cookie.lifetime, in my case it is 24 hr.
2.Login to site using SSO.
3.Check in the browser, SimpleSAMLAuthToken, SimpleSAMLSessionID , PhpSession cookie is set to 24 hr.
4.Logout and check in the browser again. SimpleSAMLAuthToken, SimpleSAMLSessionID are still there.
4.Login again ,PhpSession and SimpleSAMLAuthToken cookies are reset to 24 hr but SimpleSAMLSessionID cookie has the same old value.(Refer to screenshot)
Comment #6
drupalite1411 commentedComment #7
drupalite1411 commented