Logout

RP-initiated logout: GET|POST <issuer>/oauth2/logout

A client signs a user out (OpenID Connect RP-Initiated Logout 1.0) by sending the browser with an id_token_hint: an ID token this company issued to it, however old.

• Without a hint that reads as one, or with a client_id other than the hint's own, nothing is ended and the browser stays on a refusal page.
• The session the browser's cookie holds is ended only when it is the session the hint names; the cookie is cleared and the ending recorded in the audit trail.
• The browser goes back only to a post_logout_redirect_uri the client registered, matched exactly, with its state. Any other value is never followed and a signed-out page is shown instead.
• A cross-site POST carries no session cookie (SameSite=Lax), so a client signs users out with a GET redirect.

Discovery advertises the endpoint as end_session_endpoint.

Back-channel logout

When a session ends here, by the logout endpoint, a sign-out from the account portal or a revocation that ends sessions, every client that received tokens in that session and registered a backchannel_logout_uri is told (OpenID Connect Back-Channel Logout 1.0).

• The ending and the owed notice are written in one commit, so a crash between them loses nothing.
• Each client gets its own logout token: a JWT of type logout+jwt signed with the company's key, addressed to that client, naming the session (sid) and the subject that client knows the user by, valid for two minutes.
• It arrives as POST with the form field logout_token; 200 or 204 means told.
• The URI must be https. An address in the link-local range, cloud metadata services among them, is never called, a redirect is never followed, and each client has five seconds.
• A client that was not told is tried again after 5 seconds, then twice as long each time up to an hour, at most ten times.

A session that simply expires tells nobody; a client's own sessions should expire with it.