azure - Adal JS - 仅注销一个 AD 站点

Question

我正在开发一个使用 ADAL JS 的 SPA。调用 adalService.logOut() 后，用户会正确重定向到 microsoft oauth 注销 URL，并且注销发生得很好。但是，用户已从所有 Microsoft 365 网站和使用 ADAL 的所有其他网站注销。

有没有一种方法可以只让用户退出这个网站？

Answer 1

不幸的是，ADAL JS 库的工作方式正如您所描述的那样。当调用注销函数时，它会清除整个缓存。根据维基百科: https://github.com/AzureAD/azure-activedirectory-library-for-js/wiki/Login-methods#logout

Logout When the logout method is called, the library clears the application cache in the browser storage and sends a logout request to the Azure AD instance's logout endpoint.

authContext.logOut(); The default behavior is to redirect the user to window.location.href after logout. If a postLogoutRedirectUri value is set at the config time, the user will be redirected to that URI.

手动注销的唯一其他方法。也就是说，您自己查看缓存，然后删除您有兴趣删除的信息。这会在某种程度上“注销”用户，因为您已经删除了对 token 的访问权限。

根据 wiki 的配置身份验证上下文 https://github.com/AzureAD/azure-activedirectory-library-for-js/wiki/Config-authentication-context :

cacheLocation - ADAL caches tokens in the browser storage which defaults to 'sessionStorage'. You can set this to either 'localStorage' or 'sessionStorage'.

window.config = {
    clientId: 'g075edef-0efa-453b-997b-de1337c29185',
    cacheLocation: 'localStorage' // Default is sessionStorage
}; Tokens are accessible from JavaScript since ADAL.JS is using HTML5 browser storage. It is recommended to prompt users to login

again for important operations in your app. You should also protect your site for XSS. Please check the article here: https://www.owasp.org/index.php/XSS_(Cross_Site_Scripting)_Prevention_Cheat_Sheet

You can read further details about the other configurable options here.

有关访问本地存储的更多信息，您可以在此处阅读:https://blog.logrocket.com/the-complete-guide-to-using-localstorage-in-javascript-apps-ba44edb53a36

用于存储的 MDN Web 文档可以在这里找到:https://developer.mozilla.org/en-US/docs/Web/API/Storage