message: Bug Delete the hashed session token on user logout
diff: @@ -2,7 +2,9 @@ package server
  import (
  "context"
  + "crypto/sha256"
  "crypto/tls"
  + "encoding/base64"
  "fmt"
  "html/template"
  "io"
  @@ -11,6 +13,7 @@ import (
  "net/url"
  "os"
  "path"
  + "strings"
  "github.com/coreos/dex/api"
  "github.com/coreos/pkg/capnslog"
  @@ -48,6 +51,8 @@ const (
  customLogoEndpoint = "/custom-logo"
  helmChartRepoProxyEndpoint = "/api/helm/charts/"
  gitopsEndpoint = "/api/gitops/"
  +
  + sha256Prefix = "sha256~"
  )
  var (
  @@ -516,8 +521,13 @@ func (s *Server) handleOpenShiftTokenDeletion(user *auth.User, w http.ResponseWr
  return
  }
  + tokenName := user.Token
  + if strings.HasPrefix(tokenName, sha256Prefix) {
  + tokenName = tokenToObjectName(tokenName)
  + }
  +
  // Delete the OpenShift OAuthAccessToken.
  - path := "/apis/oauth.openshift.io/v1/oauthaccesstokens/" + user.Token
  + path := "/apis/oauth.openshift.io/v1/oauthaccesstokens/" + tokenName
  url := proxy.SingleJoiningSlash(s.K8sProxyConfig.Endpoint.String(), path)
  req, err := http.NewRequest("DELETE", url, nil)
  if err != nil {
  @@ -536,3 +546,11 @@ func (s *Server) handleOpenShiftTokenDeletion(user *auth.User, w http.ResponseWr
  io.Copy(w, resp.Body)
  resp.Body.Close()
  }
  +
  +// tokenToObjectName returns the oauthaccesstokens object name for the given raw token,
  +// i.e. the sha256 hash prefixed with "sha256~".
  +func tokenToObjectName(token string) string {
  + name := strings.TrimPrefix(token, sha256Prefix)
  + h := sha256.Sum256([]byte(name))
  + return sha256Prefix + base64.RawURLEncoding.EncodeToString(h[0:])
  +}
  