fix: invoking logout without credentials no longer throws error

OKTA-436562 <<<Jenkins Check-In of Tested SHA: 25daa00 for [email protected]>>> Artifact: okta-oidc-middleware Files changed count: 3 PR Link: "#37"
okta · Nov 30, 2021 · b8845f4 · b8845f4
1 parent f2d0216
commit b8845f4
Show file tree

Hide file tree

Showing 3 changed files with 20 additions and 1 deletion.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -1,3 +1,9 @@
+# 4.3.0
+
+### Bug Fixes
+
+- [#37](https://github.com/okta/okta-oidc-middleware/pull/37) fix: `.logout` no longer throws error without valid credentials
+
 # 4.2.0
 
 ### Bug Fixes

diff --git a/src/logout.js b/src/logout.js
@@ -55,6 +55,10 @@ logout.forceLogoutAndRevoke = context => {
   }
   const revokeToken = makeTokenRevoker({ issuer, client_id, client_secret, errorHandler: makeErrorHandler(emitter) });
   return async (req, res /*, next */) => {
+    if (!req.userContext) {
+      return res.sendStatus(401);
+    }
+
     const tokens = req.userContext.tokens;
     const revokeIfExists = token_hint => tokens[token_hint] ? revokeToken({token_hint, token: tokens[token_hint]}) : null;
     const revokes = REVOKABLE_TOKENS.map( revokeIfExists );

diff --git a/test/unit/logout.spec.js b/test/unit/logout.spec.js
@@ -73,7 +73,16 @@ describe('logout', () => {
         };
       });
 
-
+      describe('logout without active session', () => {
+        it('returns 401', async () => {
+          res.sendStatus = jest.fn();
+          req.userContext = undefined;
+          await logout(req, res);
+          expect(fetch).not.toHaveBeenCalled();
+          expect(res.sendStatus).toHaveBeenCalledWith(401);
+        });
+      });
+
       describe('revoke tokens', () => {
         it('revokes refresh_token', async () => {
           const tokenVal = 'sometoken';