# OKTA express Oidc middle ware login/ logout redirections

**URL:** <https://devforum.okta.com/t/okta-express-oidc-middle-ware-login-logout-redirections/1189>\
**Category:** OAuth/OIDC\
**Created:** [February 6, 2018, 7:07pm UTC](https://devforum.okta.com/t/okta-express-oidc-middle-ware-login-logout-redirections/1189 "2018-02-06T19:07:39Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![reemasaluja](https://avatars.discourse-cdn.com/v4/letter/r/d6d6ee/32.png) [@reemasaluja](https://devforum.okta.com/u/reemasaluja)\
**Post date:** [February 6, 2018, 7:07pm UTC](https://devforum.okta.com/t/okta-express-oidc-middle-ware-login-logout-redirections/1189/1 "2018-02-06T19:07:39Z")

</div>

Hello .

I am currently working on Okta login/logout integration in my application.  
On front end we have Angular and Backend is Node with express middleware

I have login Page, which uses Okta Sign in Widget . Once user is logged in oidc.ensureAuthentication () function is called on every protect route to make sure its a valid session.

I have expressOIDC middleware set up in my server .js file

```auto
var oidc = new ExpressOIDC({
    issuer: `${configSettings.orgUrl}/oauth2/default`,
    client_id: configSettings.keys.id,
    client_secret: configSettings.keys.clientSecret,
    redirect_uri: configSettings.keys.redirectUri,
    routes: {
        login:{
            path:'/user/sign-in-beta'
        },
        callback: { 
            handler:function(req,res,next){
                console.log('Callback........',req.user);
                next();
            },
            defaultRedirect: "/" 
        }
    },
    scope: 'openid profile email'
  });

```

As soon as user sign is , callback will print user information.

Issue is : When i logout , in oidc i am just calling  
logOff : function logOff(req, res){  
req.logout();  
res.redirect(’/’);  
},

This logout does not clear my session and it will redirect me to sign in page, because on UI i am redirecting to sing . html, but i guess there is some setting i missed or logout url redirect is not correct. I am not sure what should be the flow on logout and what setting should i add. Can somebod provide an example, or may be i missed a callback handler but by default its ‘authorization-code/callback’ which should enter into

```auto
 callback: { 
            handler:function(req,res,next){
                console.log('Callback........',req.user);
                next();
            },
            defaultRedirect: "/" 
        }

```

i am not sure

Below is my Okta App url redirects

 ![image](https://global.discourse-cdn.com/oktadev/original/1X/da5134dba507386611563b6d0e4f977483f9d631.png)

---

<div class="post-metadata">

**Author:** ![lboyette](https://avatars.discourse-cdn.com/v4/letter/l/87869e/32.png) [@lboyette](https://devforum.okta.com/u/lboyette)\
**Post date:** [February 8, 2018, 11:26pm UTC](https://devforum.okta.com/t/okta-express-oidc-middle-ware-login-logout-redirections/1189/2 "2018-02-08T23:26:32Z")

</div>

Hi @reemasaluja

First, make sure `oidc.ensureAuthentication()` isn’t on the `/` route. If it isn’t, then [follow the instructions here](https://github.com/okta/samples-nodejs-express-4/tree/master/custom-login) to set up an example with the widget. Let us know if that helps!

---

<div class="post-metadata">

**Author:** ![reemasaluja](https://avatars.discourse-cdn.com/v4/letter/r/d6d6ee/32.png) [@reemasaluja](https://devforum.okta.com/u/reemasaluja)\
**Post date:** [February 14, 2018, 10:47pm UTC](https://devforum.okta.com/t/okta-express-oidc-middle-ware-login-logout-redirections/1189/3 "2018-02-14T22:47:07Z")

</div>

I checked out the link, which you shared. Thanks, But that wont work in my case.

Let me tell you the flow

Node server boots up

1. in server.js has oidc connection established.

2. webpage - \> custom login form(with custom made url /user/sign-in), uses sign in widget - \> Authenticates- \> oidc authentication on route -\> get data from mongo db -\> and triggers next action.

Successfully signed in

**Issue is with logout**

app.get(’/logout’, function(req, res){  
req.logout(); // _ **this is undefined. no logout function in req object** _  
res.redirect(’/’);  
});

---

<div class="post-metadata">

**Author:** ![lboyette](https://avatars.discourse-cdn.com/v4/letter/l/87869e/32.png) [@lboyette](https://devforum.okta.com/u/lboyette)\
**Post date:** [February 15, 2018, 5:24pm UTC](https://devforum.okta.com/t/okta-express-oidc-middle-ware-login-logout-redirections/1189/4 "2018-02-15T17:24:58Z")

</div>

If you’re trying add additional data to the session from mongodb after login, have you seen [this section about extending the user in the README](https://github.com/okta/okta-oidc-js/tree/master/packages/oidc-middleware#extending-the-user)?

If `logout` is undefined, it’s probably because of the order of the routes. `app.use(oidc.router);` [must come before you attach any of your own routes](https://github.com/okta/samples-nodejs-express-4/blob/master/common/sample-web-server.js#L51) in order for `logout` to be available.

---

<div class="post-metadata">

**Author:** ![reemasaluja](https://avatars.discourse-cdn.com/v4/letter/r/d6d6ee/32.png) [@reemasaluja](https://devforum.okta.com/u/reemasaluja)\
**Post date:** [February 15, 2018, 5:44pm UTC](https://devforum.okta.com/t/okta-express-oidc-middle-ware-login-logout-redirections/1189/5 "2018-02-15T17:44:01Z")

</div>

Thanks!

1. No addition of user data. Thats just the flow i mentioned.
2. app.use(oidc.router) is defined , before any route is called.
3. Here is logout flow from client (Angular 1.5) to express route

-\>user clicks on Logout link in website.  
-\> Sign in widget logout

```
logoutWidget: function () {
              var deferred = $q.defer();
              widget.session.exists(function(exists){
                if(exists){
                 // widget.tokenManager.remove('idToken');
                  //widget.tokenManager.clear();
                  widget.signOut();
                  deferred.resolve("Signed out");
                } else {
                  deferred.resolve("Already Signed Out");
                }
              });
              return deferred.promise;
            }

```

-\> hit server with some service : userService.logoutUser() -\> which fires  
app.get(’/logout’, function(req, res){  
req.logout();  
res.redirect(’/’);  
});

I feel /logout should fire by itself when sign in widgets fires signout? , but i have to fire it manually.

my logout url on browser is “[http://localhost:8080/user/logout](http://localhost:8080/user/logout)”

Also nothing is provided in okta configuration for Logout URLS field

---

<div class="post-metadata">

**Author:** ![lboyette](https://avatars.discourse-cdn.com/v4/letter/l/87869e/32.png) [@lboyette](https://devforum.okta.com/u/lboyette)\
**Post date:** [February 16, 2018, 7:36pm UTC](https://devforum.okta.com/t/okta-express-oidc-middle-ware-login-logout-redirections/1189/6 "2018-02-16T19:36:26Z")

</div>

1. Sounds good!

2. Just to be clear, it must be defined before other routes are defined, not just defined before the other routes are called:

3. The flow seems strange. If the browser knows the `id_token` or `access_token` and sends an `access_token` to the server, then you’re doing the implicit flow and `oidc-middleware` isn’t for you. If the implicit flow is what you want, we currently have [`@okta/jwt-verifier` to verify incoming tokens](https://github.com/okta/okta-oidc-js/tree/master/packages/jwt-verifier) to routes.

You may want to look through [our new Authentication Guide](https://developer.okta.com/authentication-guide/) to determine which flow you want (authorization code flow or implicit), as that decision is application-specific.

---

<div class="post-metadata">

**Author:** ![reemasaluja](https://avatars.discourse-cdn.com/v4/letter/r/d6d6ee/32.png) [@reemasaluja](https://devforum.okta.com/u/reemasaluja)\
**Post date:** [February 20, 2018, 6:53pm UTC](https://devforum.okta.com/t/okta-express-oidc-middle-ware-login-logout-redirections/1189/7 "2018-02-20T18:53:27Z")

</div>

Make sense. Thanks for clarification.

This makes sense

---

<div class="post-metadata">

**Author:** ![reemasaluja](https://avatars.discourse-cdn.com/v4/letter/r/d6d6ee/32.png) [@reemasaluja](https://devforum.okta.com/u/reemasaluja)\
**Post date:** [February 26, 2018, 10:49pm UTC](https://devforum.okta.com/t/okta-express-oidc-middle-ware-login-logout-redirections/1189/8 "2018-02-26T22:49:31Z")

</div>

What if i want to use both oidc middleware and sign in widget. How should i implement logout functionality with OIDC

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/oktadev/original/1X/589c4c5f80de422d01f47cee7185a7fb8227835c.png) [@system](https://devforum.okta.com/u/system)\
**Post date:** [January 12, 2024, 9:38pm UTC](https://devforum.okta.com/t/okta-express-oidc-middle-ware-login-logout-redirections/1189/9 "2024-01-12T21:38:38Z")

</div>

This topic was automatically closed 24 hours after the last reply. New replies are no longer allowed.