From 6cd06831f01b49eb51f57a9a49b277d91dfab638 Mon Sep 17 00:00:00 2001
From: Lukasz Raczylo <lukasz@raczylo.com>
Date: Tue, 24 Sep 2024 12:08:19 +0100
Subject: [PATCH] Add logout URL to the invalid authentication email.

This is to prevent deadlock when user has logged in with wrong email address.
---
 main.go | 19 ++++++++++++-------
 1 file changed, 12 insertions(+), 7 deletions(-)

diff --git a/main.go b/main.go
index c0dd21e..991f3be 100644
--- a/main.go
+++ b/main.go
@@ -165,11 +165,16 @@ func New(ctx context.Context, next http.Handler, config *Config, name string) (h
 	}
 
 	t := &TraefikOidc{
-		next:           next,
-		name:           name,
-		store:          store,
-		redirURLPath:   config.CallbackURL,
-		logoutURLPath:  config.LogoutURL,
+		next:         next,
+		name:         name,
+		store:        store,
+		redirURLPath: config.CallbackURL,
+		logoutURLPath: func() string {
+			if config.LogoutURL == "" {
+				return config.CallbackURL + "/logout"
+			}
+			return config.LogoutURL
+		}(),
 		issuerURL:      metadata.Issuer,
 		tokenBlacklist: NewTokenBlacklist(),
 		jwkCache:       &JWKCache{},
@@ -313,14 +318,14 @@ func (t *TraefikOidc) ServeHTTP(rw http.ResponseWriter, req *http.Request) {
 
 		email, _ := claims["email"].(string)
 		if email == "" {
-			t.logger.Errorf("No email found in token claims")
+			t.logger.Debugf("No email found in token claims")
 			t.initiateAuthentication(rw, req, session, t.redirectURL)
 			return
 		}
 
 		if !t.isAllowedDomain(email) {
 			t.logger.Infof("User with email %s is not from an allowed domain", email)
-			http.Error(rw, "Access denied: Your email domain is not allowed", http.StatusForbidden)
+			http.Error(rw, fmt.Sprintf("Access denied: Your email domain is not allowed. <a href=\"%s\">Log me out</a>", t.logoutURLPath), http.StatusForbidden)
 			return
 		}