The `federated` config key was ambiguous. Rename to `federatedLogout`
for clarity since it specifically controls federated logout behavior.
Signed-off-by: Jonathan Roebuck <jroebuck@spotify.com>
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Add server-side URL validation for logoutUrl (HTTPS + localhost only),
origin validation on the logout endpoint, and a configurable `federated`
option (default false) for Auth0 provider logout. Includes comprehensive
test coverage for all security controls.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Jack Palmer <jackpalmer@spotify.com>
Jonathan Roebuck