STIGQter: STIG Summary: Red Hat OpenShift Container Platform 4.x Security Technical Implementation Guide Version: 2 Release: 6 Benchmark Date: 01 Jul 2026:

OpenShift must display an explicit logout message indicating the reliable termination of authenticated communication sessions.

DISA Rule

SV-257556r961227_rule

Vulnerability Number

V-257556

Group Title

SRG-APP-000297-CTR-000705

Rule Version

CNTR-OS-000650

Severity

CAT III

CCI(s)

• CCI-002364 - Display an explicit logout message to users indicating the reliable termination of authenticated communications sessions.

Weight

10

Fix Recommendation

Configure the web console's logout redirect to direct to an appropriate logout page. If OpenShift is configured to use an OIDC provider, then the redirect needs to first go to the OIDC provider's logout page, and then it can be redirected to another logout page as needed.

Run the following command to update the console:

oc patch console.config.openshift.io cluster --type merge -p '{"spec":{"authentication":{"logoutRedirect":"<LOGOUT_URL>"}}}'

where LOGOUT_URL is set to the logout page.

Check Contents

Verify the logout redirect setting in web console configuration is set by executing the following:

oc get console.config.openshift.io cluster -o jsonpath='{.spec.authentication.logoutRedirect}{"\n"}'

If nothing is returned, this is a finding.

Vulnerability Number

V-257556

Documentable

False

Rule Version

CNTR-OS-000650

Severity Override Guidance

Verify the logout redirect setting in web console configuration is set by executing the following:

oc get console.config.openshift.io cluster -o jsonpath='{.spec.authentication.logoutRedirect}{"\n"}'

If nothing is returned, this is a finding.

Check Content Reference

M

Target Key

5547