{"record":{"id":"af895d074ab84457","repo":"quarkusio/quarkus","slug":"q-post-logout-cookie-is-not-available","errorCode":null,"errorMessage":"q_post_logout cookie is not available","messagePattern":"q_post_logout cookie is not available","errorType":"http","errorClass":"InternalServerErrorException","httpStatus":500,"severity":"error","filePath":"integration-tests/oidc-code-flow/src/main/java/io/quarkus/it/keycloak/TenantLogout.java","lineNumber":45,"sourceCode":"        return \"Tenant Logout, refreshed: \" + (context.get(\"refresh_token_grant_response\") != null);\n    }\n\n    // It is needed for the proactive-auth=false to work: /tenant-logout/logout should match a user initiated logout request\n    // which must be handled by `CodeAuthenticationMechanism`.\n    // Adding `@Authenticated` gives control to `CodeAuthenticationMechanism` instead of RestEasy.\n    @GET\n    @Authenticated\n    @Path(\"logout\")\n    public String getTenantLogoutPath() {\n        throw new InternalServerErrorException();\n    }\n\n    @GET\n    @Path(\"post-logout\")\n    public String postLogout(@QueryParam(\"state\") String postLogoutState) {\n        Cookie cookie = headers.getCookies().get(\"q_post_logout_tenant-logout\");\n        if (cookie == null) {\n            throw new InternalServerErrorException(\"q_post_logout cookie is not available\");\n        }\n        if (postLogoutState == null) {\n            throw new InternalServerErrorException(\"'state' query parameter is not available\");\n        }\n        if (!postLogoutState.equals(cookie.getValue())) {\n            throw new InternalServerErrorException(\"'state' query parameter is not equal to the q_post_logout cookie value\");\n        }\n        return \"You were logged out, please login again\";\n    }\n}\n","sourceCodeStart":27,"sourceCodeEnd":56,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/integration-tests/oidc-code-flow/src/main/java/io/quarkus/it/keycloak/TenantLogout.java#L27-L56","documentation":"TenantLogout's post-logout endpoint expects the 'q_post_logout_tenant-logout' cookie that Quarkus OIDC sets when redirecting to the provider's post-logout page. If the cookie is absent, the post-logout flow did not run through the OIDC logout redirect, so the endpoint fails fast.","triggerScenarios":"A user (or test) navigates directly to /tenant-logout/post-logout without first going through the OIDC RP-initiated logout redirect that sets the cookie; browser/cookie jar dropped the cookie.","commonSituations":"Calling the post-logout URL manually; cookie blocked by SameSite/secure attributes; logout initiated without quarkus.oidc.logout.post-logout path configured so the cookie is never set.","solutions":["Initiate logout via the OIDC logout flow (GET /tenant-logout/logout or the provider's end_session_endpoint) so Quarkus sets q_post_logout_tenant-logout before the callback","Check cookie settings (path, SameSite, secure) so the cookie survives the redirect to the provider and back","Confirm quarkus.oidc.<tenant>.logout.post-logout.path is configured to match /tenant-logout/post-logout"],"exampleFix":"// before\nCookie cookie = headers.getCookies().get(\"q_post_logout_tenant-logout\");\nif (cookie == null) {\n    throw new InternalServerErrorException(\"q_post_logout cookie is not available\");\n}\n// after\nCookie cookie = headers.getCookies().get(\"q_post_logout_tenant-logout\");\nif (cookie == null) {\n    return \"post-logout cookie missing; complete the OIDC logout flow first\";\n}","handlingStrategy":"validation","validationCode":"Cookie cookie = headers.getCookies().get(\"q_post_logout_tenant-logout\");\nif (cookie == null) {\n    // restart the RP-initiated logout flow before calling post-logout\n}","typeGuard":null,"tryCatchPattern":"try {\n    given().get(\"/tenant-logout/post-logout\");\n} catch (InternalServerErrorException e) {\n    if (e.getMessage().contains(\"q_post_logout cookie\")) {\n        // complete the logout redirect flow first\n    }\n}","preventionTips":["Always initiate logout via the OIDC logout endpoint, never the post-logout URL directly","Check cookie SameSite/secure attributes survive the provider round-trip","Verify logout.post-logout.path config matches the endpoint path"],"tags":["oidc","logout","cookie"],"backgroundTag":"missing-post-logout-cookie","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}