使用Auth0注销时Heroku“returnTo”查询字符串参数错误

Question

I am using Heroku and have deployed mostly successfully. The logout has me really stumped. According to docs I should be passing a url like,

https://xxxxauth0tennantxxxx/v2/logout or https://YOUR_DOMAIN/v2/logout?returnTo=http%3A%2F%2Fwww.example.com

When I do, I get OK back. But I am using the below code from the Auth0 docs which builds the url including the port number.

router.get('/logout', (req, res) => {
  req.logOut();
  let returnTo = req.protocol + '://' + req.hostname;
  const port = req.connection.localPort;
  if (port !== undefined && port !== 80 && port !== 443) {
    returnTo += ':' + port;
  }
  const logoutURL = new url.URL(
    util.format('https://%s/v2/logout', process.env.AUTH0_DOMAIN),
  );
  const searchString = querystring.stringify({
    client_id: process.env.AUTH0_CLIENT_ID,
    returnTo: returnTo,
  });
  logoutURL.search = searchString;
  res.redirect(logoutURL);
});

Heroku automatically assigns a port however so therefore everytime I try to logout I am met with an error of The "returnTo" querystring parameter "http://xxxxx.herokuapp.com:12345" is not defined as a valid URL in "Allowed Logout URLs".

I have tried to add every variant allowed logout url I can try but with no luck http://localhost:8000,http://*.herokuapp.com,https://*.auth0.com/v2/logout,https://*.auth0.com/,https://xxxxxxx.auth0.com I even tried setting app.set('trust proxy', 1); as some docs suggest for Heroku.

Please, how can I account for the dynamic port heroku assigns in my logout url?

Edit: I have tried this variant of the endpoint too

And I have tried to edit the endpoint call as

    router.get('/logout', (req, res) => {
    let returnTo = req.protocol + '://' + req.hostname;
    const port = req.connection.localPort;
    if (port !== undefined && port !== 80 && port !== 443) {
    returnTo = process.env.NODE_ENV === 'production' ? `${returnTo}/` : `${returnTo}:${port}/`;
  }
    req.logout();
    if (req.session) {
      req.session.destroy(function(err) {
        if (err) {
          console.log(err);
      }
      console.log('Destroyed the user session on Auth0 endpoint');
      res.redirect(req.protocol + '://' + process.env.AUTH0_DOMAIN + '/v2/logout?client_id=' + process.env.AUTH0_CLIENT_ID + '&returnTo=' + returnTo +' ');
    });
    }
    });

Answer 1

As the error message indicates, you need to add the http://xxxxx.herokuapp.com:12345 to the Allowed Logout URLs in your application settings. Replace XXXXX with heroku app name and include the port number as well.

Answer 2

Finally, I just removed the port when building the url and voila, logged out and redirected to home page.

  router.get('/logout', (req, res) => {
  let returnTo = req.protocol + '://' + req.hostname;
  const port = req.connection.localPort;
  if (port !== undefined && port !== 80 && port !== 443) {
    returnTo = process.env.NODE_ENV === 'production' ? `${returnTo}/` : `${returnTo}`;
  }
  req.logout();

  if (req.session) {
    req.session.destroy(function(err) {
      if (err) {
        console.log(err);
      }
      console.log('Destroyed the user session on Auth0 endpoint');

      const logoutURL = new url.URL(
          util.format('https://%s/v2/logout', process.env.AUTH0_DOMAIN),
      );
      const searchString = querystring.stringify({
        client_id: process.env.AUTH0_CLIENT_ID,
        returnTo: returnTo,
      });
      logoutURL.search = searchString;

      res.redirect(logoutURL);

    });
  }
});

What a difference some rest does for tired eyes, there is so much (excellent) documentation, it's just very confusing and overwhelming but I think I got it now. Now to check all is secure and safe to use.