0

I have a simple Laravel application, in which a third party is redirecting to a route from an external source.

This external site hits a very simple logout controller at /saml/logout


<?php

namespace App\Http\Controllers\Saml;

use App\Http\Controllers\Controller;
use Illuminate\Http\Request;
use Log;

class LogoutController extends Controller
{
    /**
     * Entry point for SAML logout.
     * TODO: check if you need auth to go here.
     *
     * @param \Illuminate\Http\Request $request
     *
     * @return void
     */
    public function logout(Request $request)
    {
        Log::info('Response:', (array) request());
        Log::info('Response:', (array) $_REQUEST);
        Log::info('Response:', (array) $_GET);
        Log::info('Response:', (array) $_POST);
        Log::info('Response:', (array) $request->method());
    }
}

Here is the trace I can see:

enter image description here

So, according to this tracer its able to hit the URL and get a HTTP status of 200.

enter image description here

However, in my logs I get the following.

enter image description here

My question is, why am I getting nothing in my logs in regards to the request?

The only thing I can see that's slightly odd is that something called Sec-Fetch-Dest is set to iframe.

An update given answers.

Using $request->all() gives me nothing.

enter image description here

A further update

enter image description here

Jesse Luke Orange
  • 1,949
  • 3
  • 29
  • 71
  • 2
    https://laravel.com/docs/8.x/requests#retrieving-input – Don't Panic May 21 '21 at 12:53
  • `request()` returns an instance of the request class not of the request data. – shaedrich May 21 '21 at 12:54
  • `GET .../saml/logout` - what are you expecting to see in the request? There is nothing in either `$_GET` or `$_POST`, right? Try `GET .../saml/logout?foo=bar`, log `$request->all();`. – Don't Panic May 21 '21 at 14:05
  • I was expecting a SAML response under a variable like SamlRequest, but it appears to not be in the request. This is a decent theory because it could well be that this third party isn't sending anything. – Jesse Luke Orange May 21 '21 at 14:23
  • The request is not the response. `$_GET` and `$_POST` and Laravel's `$request` are all related to the incoming request, sent by the browser. The response is how the server responds to that request. – Don't Panic May 21 '21 at 15:23
  • Apologies, that was poor wording in the logs. I understand. I just find it odd that this third party is claiming to be sending data, but if this were indeed the case, am I write in thinking at least one of the above would've picked it up. – Jesse Luke Orange May 21 '21 at 15:28

1 Answers1

1

Try $request->all()

public function logout(Request $request)
{
    Log::info('Response:', $request->all());
}
VIKAS KATARIYA
  • 5,867
  • 3
  • 17
  • 34