quarkusio/quarkus · error · InternalServerErrorException

q_post_logout cookie is not available

Error message

q_post_logout cookie is not available

What it means

TenantLogout's post-logout endpoint expects the 'q_post_logout_tenant-logout' cookie that Quarkus OIDC sets when redirecting to the provider's post-logout page. If the cookie is absent, the post-logout flow did not run through the OIDC logout redirect, so the endpoint fails fast.

Source

Thrown at integration-tests/oidc-code-flow/src/main/java/io/quarkus/it/keycloak/TenantLogout.java:45

        return "Tenant Logout, refreshed: " + (context.get("refresh_token_grant_response") != null);
    }

    // It is needed for the proactive-auth=false to work: /tenant-logout/logout should match a user initiated logout request
    // which must be handled by `CodeAuthenticationMechanism`.
    // Adding `@Authenticated` gives control to `CodeAuthenticationMechanism` instead of RestEasy.
    @GET
    @Authenticated
    @Path("logout")
    public String getTenantLogoutPath() {
        throw new InternalServerErrorException();
    }

    @GET
    @Path("post-logout")
    public String postLogout(@QueryParam("state") String postLogoutState) {
        Cookie cookie = headers.getCookies().get("q_post_logout_tenant-logout");
        if (cookie == null) {
            throw new InternalServerErrorException("q_post_logout cookie is not available");
        }
        if (postLogoutState == null) {
            throw new InternalServerErrorException("'state' query parameter is not available");
        }
        if (!postLogoutState.equals(cookie.getValue())) {
            throw new InternalServerErrorException("'state' query parameter is not equal to the q_post_logout cookie value");
        }
        return "You were logged out, please login again";
    }
}

View on GitHub (pinned to e1c734241f)

Solutions

1. Initiate logout via the OIDC logout flow (GET /tenant-logout/logout or the provider's end_session_endpoint) so Quarkus sets q_post_logout_tenant-logout before the callback
2. Check cookie settings (path, SameSite, secure) so the cookie survives the redirect to the provider and back
3. Confirm quarkus.oidc.<tenant>.logout.post-logout.path is configured to match /tenant-logout/post-logout

Example fix

// before
Cookie cookie = headers.getCookies().get("q_post_logout_tenant-logout");
if (cookie == null) {
    throw new InternalServerErrorException("q_post_logout cookie is not available");
}
// after
Cookie cookie = headers.getCookies().get("q_post_logout_tenant-logout");
if (cookie == null) {
    return "post-logout cookie missing; complete the OIDC logout flow first";
}

Cookie cookie = headers.getCookies().get("q_post_logout_tenant-logout");
if (cookie == null) {
    // restart the RP-initiated logout flow before calling post-logout
}

try {
    given().get("/tenant-logout/post-logout");
} catch (InternalServerErrorException e) {
    if (e.getMessage().contains("q_post_logout cookie")) {
        // complete the logout redirect flow first
    }
}

When it happens

Trigger: A user (or test) navigates directly to /tenant-logout/post-logout without first going through the OIDC RP-initiated logout redirect that sets the cookie; browser/cookie jar dropped the cookie.

Common situations: Calling the post-logout URL manually; cookie blocked by SameSite/secure attributes; logout initiated without quarkus.oidc.logout.post-logout path configured so the cookie is never set.

Related errors

• Back-channel logout path cannot contain a wildcard '*' chara
• OIDC tenants '%s' and '%s' share the same back-channel logou
• Access token expires_in property in the session cookie must
• 'state' query parameter is not available
• 'state' query parameter is not equal to the q_post_logout co

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/af895d074ab84457. Report an issue: GitHub.