Merge pull request #11076 from johnson-yi/fixes/saml_slo

Fixes #10706 - Fix saml slo for logout

app/Http/Controllers/Auth/LoginController.php

@@ -449,10 +449,17 @@ class LoginController extends Controller
      */
     public function logout(Request $request)
     {
+        // Logout is only allowed with a http POST but we need to allow GET for SAML SLO
         $settings = Setting::getSettings();
         $saml = $this->saml;
+        $samlLogout = $request->session()->get('saml_logout');
         $sloRedirectUrl = null;
         $sloRequestUrl = null;
+    
+        // Only allow GET if we are doing SAML SLO otherwise abort with 405
+        if ($request->isMethod('GET') && !$samlLogout) {
+            abort(405);
+        }
 
         if ($saml->isEnabled()) {
             $auth = $saml->getAuth();

app/Http/Controllers/Auth/SamlController.php

@@ -142,6 +142,6 @@ class SamlController extends Controller
             return view('errors.403');
         }
 
-        return redirect()->route('logout')->with('saml_slo_redirect_url', $sloUrl);
+        return redirect()->route('logout')->with(['saml_logout' => true,'saml_slo_redirect_url' => $sloUrl]);
     }
 }

routes/web.php

@@ -434,6 +434,12 @@ Route::group(['middleware' => 'web'], function () {
             'uses' => 'DashboardController@getIndex' ]
     );
 
+    // need to keep GET /logout for SAML SLO
+    Route::get(
+        'logout',
+        [LoginController::class, 'logout']
+    )->name('logout');
+
     Route::post(
         'logout',
         [LoginController::class, 'logout']