Destroy session cookies on logout (#2278)

patrickharriscatalyst1 · monkeyiq · web-flow · commit b02d7b3739aa · 2025-02-19T08:54:23.000+10:00
* Destroy session cookies on logout

* Update ServiceProvider.php

* We can use $this-&gt;session here

The active session is passed to the ctor by Symfony for us. It is not an optional (?) arg so we don't have to deref check.

* lint

---------

Co-authored-by: monkeyiq &lt;monkeyiq@gmail.com&gt;
diff --git a/modules/saml/src/Controller/ServiceProvider.php b/modules/saml/src/Controller/ServiceProvider.php
@@ -579,6 +579,10 @@ public function singleLogoutService(Request $request, string $sourceId): Respons
 
             $state = $this->authState::loadState($relayState, 'saml:slosent');
             $state['saml:sp:LogoutStatus'] = $message->getStatus();
+
+            // Destroy session cookies.
+            $this->session->updateSessionCookies(['expire' => true]);
+
             return $source::completeLogout($state);
         } elseif ($message instanceof LogoutRequest) {
             Logger::debug('module/saml2/sp/logout: Request from ' . $idpEntityId);
