add comment

gravitational · Jun 21, 2024 · 2434364 · 2434364
1 parent e548196
commit 2434364
Showing 1 changed file with 3 additions and 0 deletions.
diff --git a/lib/web/apiserver.go b/lib/web/apiserver.go
@@ -2193,6 +2193,9 @@ func (h *Handler) deleteWebSession(w http.ResponseWriter, r *http.Request, _ htt
 
 	// If the user has SAML SLO (single logout) configured, return a redirect link to the SLO URL.
 	if user != nil && len(user.GetSAMLIdentities()) > 0 && user.GetSAMLIdentities()[0].SAMLSingleLogoutURL != "" {
+		// The WebUI will redirect the user to this URL to initiate the SAML SLO on the IdP side. This is safe because this URL
+		// is hard-coded in the auth connector and can't be modified by the end user. Additionally, the user's Teleport session has already
+		// been invalidated by this point so there is nothing to hijack.
 		return map[string]interface{}{"samlSloUrl": user.GetSAMLIdentities()[0].SAMLSingleLogoutURL}, nil
 	}