From 3bddf23896636d2296bf45996db75e1d115d0ab0 Mon Sep 17 00:00:00 2001
From: Jonathan Roebuck <jroebuck@spotify.com>
Date: Wed, 1 Apr 2026 13:43:34 +0100
Subject: [PATCH] refactor(auth0): use URL/URLSearchParams for logout URL
 construction

Replace manual string concatenation with URL and URLSearchParams for
safer encoding and better readability.

Signed-off-by: Jonathan Roebuck <jroebuck@spotify.com>
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---
 .../src/authenticator.ts                       | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/plugins/auth-backend-module-auth0-provider/src/authenticator.ts b/plugins/auth-backend-module-auth0-provider/src/authenticator.ts
index 7fc99ee1f1..c88243d0a8 100644
--- a/plugins/auth-backend-module-auth0-provider/src/authenticator.ts
+++ b/plugins/auth-backend-module-auth0-provider/src/authenticator.ts
@@ -126,15 +126,15 @@ export const auth0Authenticator = createOAuthAuthenticator({
   },
 
   async logout(input, { domain, clientID, federated }) {
+    const logoutUrl = new URL(`https://${domain}/v2/logout`);
+    if (federated) {
+      logoutUrl.searchParams.set('federated', '');
+    }
+    logoutUrl.searchParams.set('client_id', clientID);
     const origin = input.req.get('origin');
-    const federatedParam = federated ? 'federated&' : '';
-    const returnToParam = origin
-      ? `&returnTo=${encodeURIComponent(origin)}`
-      : '';
-    return {
-      logoutUrl: `https://${domain}/v2/logout?${federatedParam}client_id=${encodeURIComponent(
-        clientID,
-      )}${returnToParam}`,
-    };
+    if (origin) {
+      logoutUrl.searchParams.set('returnTo', origin);
+    }
+    return { logoutUrl: logoutUrl.toString() };
   },
 });