nbudin/devise_cas_authenticatable — Issue #30: cas_sessions_controller destroy methods odd service/destination URI behaviour
Author: dyson
Created: 2012-01-04 08:22:08+00:00
State: open

The destination URI in destroy of cas_sessions_controller is used by rubycas-server to set the service URI if no service URI is given.

In my app the service URI is correctly set for login as http://something.com/people/service where as the destination URI which is set on logout is just set to http://something.com.

This causes an issue if a user logs out, is taken to the rubycas-server login page with the successful sign out message and then tries to sign right back in again. This creates an INVALID_SERVICE response from rubycas-server as the service ticket is valid for the user but the service provided is incorrect and so it returns a 422 HTTP status code.

Is there a reason that the service URI isn't passed as well? And what is the point of the destination URI vs the service URI? This behaviour doesn't appear to be standard according to the CAS specs.