DELETE /oauth2/auth/sessions/login/{user} returns 404

[pixelblend]

Describe the bug

Unable to remove users session, where {user} is the subject. In our case, we set subject to be the user's UUID.

To Reproduce

Make a DELETE request to /oauth2/auth/sessions/login/{user}

Expected behavior

Invalidates a user's authentication session

Actual Behaviour

auth_1      | time="2018-11-08T16:41:57Z" level=info msg="started handling request" method=DELETE remote="172.22.0.4:49926" request=/oauth2/auth/sessions/login/fc885398-7660-4db9-8c82-07409d5cfba7
auth_1      | time="2018-11-08T16:41:57Z" level=error msg="An error occurred while handling a request" code=404 details="map[]" error="Not Found" reason= request-id= status= trace="Stack trace: \ngithub.com/ory/hydra/consent.(*SQLManager).RevokeUserAuthenticationSession\n\t/go/src/github.com/ory/hydra/consent/manager_sql.go:152\ngithub.com/ory/hydra/consent.(*Handler).DeleteLoginSession\n\t/go/src/github.com/ory/hydra/consent/handler.go:223\ngithub.com/ory/hydra/consent.(*Handler).DeleteLoginSession-fm\n\t/go/src/github.com/ory/hydra/consent/handler.go:77\ngithub.com/julienschmidt/httprouter.(*Router).ServeHTTP\n\t/go/pkg/mod/github.com/julienschmidt/[email protected]/router.go:334\ngithub.com/urfave/negroni.Wrap.func1\n\t/go/pkg/mod/github.com/urfave/[email protected]/negroni.go:46\ngithub.com/urfave/negroni.HandlerFunc.ServeHTTP\n\t/go/pkg/mod/github.com/urfave/[email protected]/negroni.go:29\ngithub.com/urfave/negroni.middleware.ServeHTTP\n\t/go/pkg/mod/github.com/urfave/[email protected]/negroni.go:38\ngithub.com/urfave/negroni.middleware.ServeHTTP-fm\n\t/go/pkg/mod/github.com/urfave/[email protected]/negroni.go:38\nnet/http.HandlerFunc.ServeHTTP\n\t/usr/local/go/src/net/http/server.go:1964\ngithub.com/ory/hydra/cmd/server.(*Handler).RejectInsecureRequests\n\t/go/src/github.com/ory/hydra/cmd/server/handler.go:282\ngithub.com/ory/hydra/cmd/server.(*Handler).RejectInsecureRequests-fm\n\t/go/src/github.com/ory/hydra/cmd/server/handler.go:61\ngithub.com/urfave/negroni.HandlerFunc.ServeHTTP\n\t/go/pkg/mod/github.com/urfave/[email protected]/negroni.go:29\ngithub.com/urfave/negroni.middleware.ServeHTTP\n\t/go/pkg/mod/github.com/urfave/[email protected]/negroni.go:38\ngithub.com/urfave/negroni.middleware.ServeHTTP-fm\n\t/go/pkg/mod/github.com/urfave/[email protected]/negroni.go:38\ngithub.com/ory/hydra/metrics/prometheus.(*MetricsManager).ServeHTTP\n\t/go/src/github.com/ory/hydra/metrics/prometheus/middleware.go:26\ngithub.com/urfave/negroni.middleware.ServeHTTP\n\t/go/pkg/mod/github.com/urfave/[email protected]/negroni.go:38\ngithub.com/urfave/negroni.middleware.ServeHTTP-fm\n\t/go/pkg/mod/github.com/urfave/[email protected]/negroni.go:38\ngithub.com/meatballhat/negroni-logrus.(*Middleware).ServeHTTP\n\t/go/pkg/mod/github.com/meatballhat/[email protected]/middleware.go:136\ngithub.com/urfave/negroni.middleware.ServeHTTP\n\t/go/pkg/mod/github.com/urfave/[email protected]/negroni.go:38\ngithub.com/urfave/negroni.(*Negroni).ServeHTTP\n\t/go/pkg/mod/github.com/urfave/[email protected]/negroni.go:96\ngithub.com/rs/cors.(*Cors).Handler.func1\n\t/go/pkg/mod/github.com/rs/[email protected]/cors.go:207\nnet/http.HandlerFunc.ServeHTTP\n\t/usr/local/go/src/net/http/server.go:1964\ngithub.com/gorilla/context.ClearHandler.func1\n\t/go/pkg/mod/github.com/gorilla/[email protected]/context.go:141\nnet/http.HandlerFunc.ServeHTTP\n\t/usr/local/go/src/net/http/server.go:1964\nnet/http.serverHandler.ServeHTTP\n\t/usr/local/go/src/net/http/server.go:2741\nnet/http.(*conn).serve\n\t/usr/local/go/src/net/http/server.go:1847\nruntime.goexit\n\t/usr/local/go/src/runtime/asm_amd64.s:1333" writer=JSON
auth_1      | time="2018-11-08T16:41:57Z" level=info msg="completed handling request" measure#http://localhost:9000/.latency=9454500 method=DELETE remote="172.22.0.4:49926" request=/oauth2/auth/sessions/login/fc885398-7660-4db9-8c82-07409d5cfba7 status=404 text_status="Not Found" took=9.4545ms

Version:

• Environment: Docker
• Version unstable

[aeneasr]

Which database are you using, MySQL or PostgreSQL? It's possible that the row check isn't working properly.

[pixelblend]

Postgres 10.5

[aeneasr]

Interesting. Are you sure this happens every time? The code is written in a way that would only throw a 404 if no session exists. It might make sense to always return 200/201 here though.

[aeneasr]

However, it seems like there is no proper test for this - putting it on the list for investigation.

[71ppz]

I have this exact issue with postgres 9.5. I didn't see a list of version compatibility. Is that located somewhere?

[awesomeUA]

looks like hydra expect subject as query argument
https://www.ory.sh/hydra/docs/reference/api/#invalidates-all-login-sessions-of-a-certain-user