One post tagged with "Session"

Logging a user out of an OpenID Connect app takes more than deleting your own session cookie. The user is still signed in at the identity provider, so the next "Sign in" click goes straight through without a password, and the other apps that share that identity provider session stay signed in too. A proper logout has three parts: clear your app's local session, send the browser to the provider's end_session_endpoint (RP-initiated logout) so the provider session ends, and let the provider tell the other apps through back-channel logout. With Casdoor, the end-session endpoint is /api/logout, back-channel logout is configured per application, and refresh tokens can be revoked at /api/login/oauth/revoke.