Can't properly logout from web application

Zero Trust Access
1

Dear community,
We recently started using Cloudflare access to authenticate, identify and restrict access to our webapp.
So far with relative success. However, we have noticed an issue with proper logout from the webapp.
Whenever a user session has expired or revoked by invoking “https://..com/cdn-cgi/access/logout”,
If the user still has a tab of the app opened, any HTTP requests made by our app to our domain receive a 302 redirect response to:

‘https://.cloudflareaccess.com/cdn-cgi/access/login/..com?kid=&redirect_url=meta=<>v=<>’

When this is done by entering our domain into the browser address bar, the redirection works fine.
However, if while the session is invalid, our app tries to perform an HTTP asynchronous request, the browser refuses to follow the redirect because of CORS policy (trying to go from our domain into cloudflareaccess.com).
CORS policy prevents the browser from providing any useful information regarding what went wrong with the HTTP request. This way, our app has no way of figuring out that the session is no longer valid
and no way of triggering a proper redirection to the login page.

The error as seen from chrome browser with personal information edited out is attached.

We followed the community tip guide, trying to find resources that might help but came up empty.
We’ve also read up on CORS, and handling CORS errors on the client side.
What we would expect is either:

  1. Our domain to be an allowed origin by the .cloudflareaccess.com
  2. The redirect we receive should be to an address within our domain, similar to “https://..com/cdn-cgi/access/login”

Both these solutions can only be applied by Cloudflare.
Is it something that we’re missing? Can we properly detect logout and redirect to the login page from the web app itself?
Thanks!

Ticket number: 1831191

cloudflare community 2
cloudflare community 21919×632 79.7 KB

3 Likes
2

I haven’t tried this yet myself in a Single Page Application (SPA), but I noticed this section of the documentation:

You can configure Access to provide a 401 response on sub-requests with an expired session token. We recommend using this response code to either force a page refresh or to display a message to the user that their session has expired.

In order to receive a 401 for expired session, add the following header to all AJAX requests:

X-Requested-With: XMLHttpRequest

This 401 appears to come directly from your.domain.tld, rather than after a redirect to subdomain.cloudflareaccess.com.

$ curl -sv https://$DOMAIN/ 2>&1 | grep '< HTTP'
< HTTP/2 302 
$ curl -svH 'X-Requested-With: XMLHttpRequest' https://$DOMAIN/ 2>&1 | grep '< HTTP'
< HTTP/2 401