From 7a7e8a67a317f297ec8a0377e00d690f010dcc6f Mon Sep 17 00:00:00 2001 From: Galindo97 Date: Thu, 14 May 2026 12:15:37 -0500 Subject: [PATCH] fix(auth): ensure id_token is cleared and set during SSO exchange for Keycloak logout --- frontend/src/routes/auth/sso/+page.server.ts | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/frontend/src/routes/auth/sso/+page.server.ts b/frontend/src/routes/auth/sso/+page.server.ts index df2560a8..9a5863a5 100644 --- a/frontend/src/routes/auth/sso/+page.server.ts +++ b/frontend/src/routes/auth/sso/+page.server.ts @@ -29,6 +29,7 @@ export const load: PageServerLoad = async ({ url, cookies }) => { const { clearAccessTokenCookies } = await import('$lib/server/access-token-cookie'); clearAccessTokenCookies(cookies); cookies.delete('refresh_token', { path: '/' }); + cookies.delete('id_token', { path: '/' }); cookies.delete('active_company_id', { path: '/' }); } @@ -148,6 +149,18 @@ export const load: PageServerLoad = async ({ url, cookies }) => { }); } + // id_token — requerido para id_token_hint en el logout de Keycloak. + // Puede venir del refresh proactivo o del exchange original. + if (typeof tokens.id_token === 'string') { + cookies.set('id_token', tokens.id_token, { + path: '/', + httpOnly: true, + secure: isProduction, + sameSite: 'lax', + maxAge: 60 * 60 * 24 * 7, + }); + } + // sso_tenant_id — HttpOnly cookie con el tenant seleccionado. // El backend lo pasa como X-Tenant-Override en Hub /auth/me para que // devuelva el tenant correcto aunque el KC token tenga otro tenant baked in.