Update the ProcessHostRedirectionResponse handler to be executed for non-errored verification responses and fix the OWIN version

src/OpenIddict.Server.AspNetCore/OpenIddictServerAspNetCoreHandlers.Device.cs

@@ -91,9 +91,10 @@ namespace OpenIddict.Server.AspNetCore
                     throw new InvalidOperationException(SR.GetResourceString(SR.ID0114));
                 }
 
-                // Note: this handler only redirects the user agent to the address specified
-                // in the AuthenticationProperties if the error is an access_denied error.
-                if (!string.Equals(context.Response.Error, Errors.AccessDenied, StringComparison.Ordinal))
+                // Note: this handler only redirects the user agent to the address specified in
+                // the properties when there's no error or if the error is an access_denied error.
+                if (!string.IsNullOrEmpty(context.Response.Error) &&
+                    !string.Equals(context.Response.Error, Errors.AccessDenied, StringComparison.Ordinal))
                 {
                     return default;
                 }

src/OpenIddict.Server.AspNetCore/OpenIddictServerAspNetCoreHandlers.Session.cs

@@ -53,11 +53,11 @@ namespace OpenIddict.Server.AspNetCore
                 RemoveCachedRequest.Descriptor,
                 AttachHttpResponseCode<ApplyLogoutResponseContext>.Descriptor,
                 AttachCacheControlHeader<ApplyLogoutResponseContext>.Descriptor,
+                ProcessHostRedirectionResponse.Descriptor,
                 ProcessPassthroughErrorResponse<ApplyLogoutResponseContext, RequireLogoutEndpointPassthroughEnabled>.Descriptor,
                 ProcessStatusCodePagesErrorResponse<ApplyLogoutResponseContext>.Descriptor,
                 ProcessLocalErrorResponse<ApplyLogoutResponseContext>.Descriptor,
                 ProcessQueryResponse.Descriptor,
-                ProcessHostRedirectionResponse.Descriptor,
                 ProcessEmptyResponse<ApplyLogoutResponseContext>.Descriptor);
 
             /// <summary>
@@ -389,7 +389,7 @@ namespace OpenIddict.Server.AspNetCore
                     = OpenIddictServerHandlerDescriptor.CreateBuilder<ApplyLogoutResponseContext>()
                         .AddFilter<RequireHttpRequest>()
                         .UseSingletonHandler<ProcessHostRedirectionResponse>()
-                        .SetOrder(ProcessQueryResponse.Descriptor.Order + 250)
+                        .SetOrder(ProcessPassthroughErrorResponse<ApplyLogoutResponseContext, RequireLogoutEndpointPassthroughEnabled>.Descriptor.Order + 250)
                         .SetType(OpenIddictServerHandlerType.BuiltIn)
                         .Build();
 
@@ -409,6 +409,14 @@ namespace OpenIddict.Server.AspNetCore
                         throw new InvalidOperationException(SR.GetResourceString(SR.ID0114));
                     }
 
+                    // Note: this handler only executes if no post_logout_redirect_uri was specified
+                    // and if the response doesn't correspond to an error, that must be handled locally.
+                    if (!string.IsNullOrEmpty(context.PostLogoutRedirectUri) ||
+                        !string.IsNullOrEmpty(context.Response.Error))
+                    {
+                        return default;
+                    }
+
                     var properties = context.Transaction.GetProperty<AuthenticationProperties>(typeof(AuthenticationProperties).FullName!);
                     if (properties is not null && !string.IsNullOrEmpty(properties.RedirectUri))
                     {

src/OpenIddict.Server.Owin/OpenIddictServerOwinHandlers.Device.cs

@@ -90,9 +90,10 @@ namespace OpenIddict.Server.Owin
                     throw new InvalidOperationException(SR.GetResourceString(SR.ID0120));
                 }
 
-                // Note: this handler only redirects the user agent to the address specified
-                // in the AuthenticationProperties if the error is an access_denied error.
-                if (!string.Equals(context.Response.Error, Errors.AccessDenied, StringComparison.Ordinal))
+                // Note: this handler only redirects the user agent to the address specified in
+                // the properties when there's no error or if the error is an access_denied error.
+                if (!string.IsNullOrEmpty(context.Response.Error) &&
+                    !string.Equals(context.Response.Error, Errors.AccessDenied, StringComparison.Ordinal))
                 {
                     return default;
                 }

src/OpenIddict.Server.Owin/OpenIddictServerOwinHandlers.Session.cs

@@ -53,10 +53,10 @@ namespace OpenIddict.Server.Owin
                 RemoveCachedRequest.Descriptor,
                 AttachHttpResponseCode<ApplyLogoutResponseContext>.Descriptor,
                 AttachCacheControlHeader<ApplyLogoutResponseContext>.Descriptor,
+                ProcessHostRedirectionResponse.Descriptor,
                 ProcessPassthroughErrorResponse<ApplyLogoutResponseContext, RequireLogoutEndpointPassthroughEnabled>.Descriptor,
                 ProcessLocalErrorResponse<ApplyLogoutResponseContext>.Descriptor,
                 ProcessQueryResponse.Descriptor,
-                ProcessHostRedirectionResponse.Descriptor,
                 ProcessEmptyResponse<ApplyLogoutResponseContext>.Descriptor);
 
             /// <summary>
@@ -371,24 +371,24 @@ namespace OpenIddict.Server.Owin
             }
 
             /// <summary>
-            /// Contains the logic responsible of processing verification responses that should trigger a host redirection.
+            /// Contains the logic responsible of processing logout responses that should trigger a host redirection.
             /// Note: this handler is not used when the OpenID Connect request is not initially handled by OWIN.
             /// </summary>
-            public class ProcessHostRedirectionResponse : IOpenIddictServerHandler<ApplyVerificationResponseContext>
+            public class ProcessHostRedirectionResponse : IOpenIddictServerHandler<ApplyLogoutResponseContext>
             {
                 /// <summary>
                 /// Gets the default descriptor definition assigned to this handler.
                 /// </summary>
                 public static OpenIddictServerHandlerDescriptor Descriptor { get; }
-                    = OpenIddictServerHandlerDescriptor.CreateBuilder<ApplyVerificationResponseContext>()
+                    = OpenIddictServerHandlerDescriptor.CreateBuilder<ApplyLogoutResponseContext>()
                         .AddFilter<RequireOwinRequest>()
                         .UseSingletonHandler<ProcessHostRedirectionResponse>()
-                        .SetOrder(ProcessQueryResponse.Descriptor.Order + 250)
+                        .SetOrder(ProcessPassthroughErrorResponse<ApplyLogoutResponseContext, RequireLogoutEndpointPassthroughEnabled>.Descriptor.Order + 250)
                         .SetType(OpenIddictServerHandlerType.BuiltIn)
                         .Build();
 
                 /// <inheritdoc/>
-                public ValueTask HandleAsync(ApplyVerificationResponseContext context)
+                public ValueTask HandleAsync(ApplyLogoutResponseContext context)
                 {
                     if (context is null)
                     {
@@ -403,9 +403,10 @@ namespace OpenIddict.Server.Owin
                         throw new InvalidOperationException(SR.GetResourceString(SR.ID0120));
                     }
 
-                    // Note: this handler only redirects the user agent to the address specified
-                    // in the AuthenticationProperties if the error is an access_denied error.
-                    if (!string.Equals(context.Response.Error, Errors.AccessDenied, StringComparison.Ordinal))
+                    // Note: this handler only executes if no post_logout_redirect_uri was specified
+                    // and if the response doesn't correspond to an error, that must be handled locally.
+                    if (!string.IsNullOrEmpty(context.PostLogoutRedirectUri) ||
+                        !string.IsNullOrEmpty(context.Response.Error))
                     {
                         return default;
                     }