Drop session cookies after refresh failure

.github/workflows/verify.yaml

@@ -26,11 +26,11 @@ jobs:
           push: false
   license-check:
     runs-on: ubuntu-latest
-    container: golang:1.15
+    container: golang:1.16
     steps:
       - uses: actions/checkout@v2
       - name: Download License Utility
-        run: go get -u github.com/google/addlicense
+        run: go install github.com/google/addlicense@master
       - name: Check License Headers
         run: |
           shopt -s globstar

server/middleware.mjs

@@ -60,7 +60,7 @@ export const tokenRefresh = () => async (req, res, next) => {
     } catch (error) {
       console.error("Error refreshing oidc token", error);
 
-      return res.redirect("/login");
+      return res.oidc.logout();
     }
   }
 

test/server/middleware.spec.js

@@ -94,7 +94,9 @@ describe("middleware", () => {
         },
       };
       response = {
-        redirect: jest.fn(),
+        oidc: {
+          logout: jest.fn(),
+        },
       };
     });
 
@@ -104,7 +106,7 @@ describe("middleware", () => {
       expect(request.accessToken).toEqual(accessToken);
       expect(next).toHaveBeenCalled();
       expect(refresh).not.toHaveBeenCalled();
-      expect(response.redirect).not.toHaveBeenCalled();
+      expect(response.oidc.logout).not.toHaveBeenCalled();
     });
 
     describe("the token is expired", () => {
@@ -120,19 +122,17 @@ describe("middleware", () => {
         expect(request.accessToken).toEqual(nextAccessToken);
         expect(refresh).toHaveBeenCalled();
         expect(next).toHaveBeenCalled();
-        expect(response.redirect).not.toHaveBeenCalled();
+        expect(response.oidc.logout).not.toHaveBeenCalled();
       });
 
-      it("should redirect the request to the login route if the refresh fails", async () => {
+      it("should end the session", async () => {
         refresh.mockRejectedValue(new Error("refresh failed"));
 
         await tokenRefresh()(request, response, next);
 
         expect(request.accessToken).toBeUndefined();
         expect(next).not.toHaveBeenCalled();
-        expect(response.redirect)
-          .toHaveBeenCalledTimes(1)
-          .toHaveBeenCalledWith("/login");
+        expect(response.oidc.logout).toHaveBeenCalledTimes(1);
       });
     });
   });