Clear split cookies on logout

Signed-off-by: Jochen Kressin <[email protected]>

server/auth/types/jwt/jwt_auth.ts

@@ -60,7 +60,7 @@ export class JwtAuthentication extends AuthenticationType {
 
   public async init() {
     this.createExtraStorage();
-    const routes = new JwtAuthRoutes(this.router, this.sessionStorageFactory);
+    const routes = new JwtAuthRoutes(this.router, this.sessionStorageFactory, this.config);
     routes.setupRoutes();
   }
 

server/auth/types/jwt/routes.ts

@@ -13,16 +13,41 @@
  *   permissions and limitations under the License.
  */
 
-import { IRouter, SessionStorageFactory } from 'opensearch-dashboards/server';
+import {
+  IRouter,
+  Logger,
+  SessionStorageFactory
+} from 'opensearch-dashboards/server';
 import { SecuritySessionCookie } from '../../../session/security_cookie';
 import { API_AUTH_LOGOUT, API_PREFIX } from '../../../../common';
+import {
+  clearSplitCookies,
+  ExtraAuthStorageOptions
+} from "../../../session/cookie_splitter";
+import {JWT_DEFAULT_EXTRA_STORAGE_OPTIONS} from "./jwt_auth";
+import {SecurityPluginConfigType} from "../../../index";
 
 export class JwtAuthRoutes {
   constructor(
     private readonly router: IRouter,
-    private readonly sessionStorageFactory: SessionStorageFactory<SecuritySessionCookie>
+    private readonly sessionStorageFactory: SessionStorageFactory<SecuritySessionCookie>,
+    private readonly config: SecurityPluginConfigType,
   ) {}
 
+  private getExtraAuthStorageOptions(logger?: Logger): ExtraAuthStorageOptions {
+    const extraAuthStorageOptions: ExtraAuthStorageOptions = {
+      cookiePrefix:
+        this.config.jwt?.extra_storage.cookie_prefix ||
+        JWT_DEFAULT_EXTRA_STORAGE_OPTIONS.cookiePrefix,
+      additionalCookies:
+        this.config.jwt?.extra_storage.additional_cookies ||
+        JWT_DEFAULT_EXTRA_STORAGE_OPTIONS.additionalCookies,
+      logger: logger,
+    };
+
+    return extraAuthStorageOptions;
+  }
+
   public setupRoutes() {
     this.router.post(
       {
@@ -33,6 +58,10 @@ export class JwtAuthRoutes {
         },
       },
       async (context, request, response) => {
+        await clearSplitCookies(
+          request,
+          this.getExtraAuthStorageOptions()
+        );
         this.sessionStorageFactory.asScoped(request).clear();
         return response.ok();
       }