Single logout explained: signing users out of every app

Single sign-on is the easy half. Users sign in once at the identity provider (IdP) and every app lets them in. Then they click "Log out" in one app, open another tab, and they're still signed in there. Or worse: they log out of the app, click "Log in" again, and get straight back in without a password, because the IdP session is still alive.

That happens because there are three layers of sessions:

1. The app's own session, usually a cookie the app set after login.
2. The IdP session, the cookie that makes SSO work.
3. Tokens the app holds: access and refresh tokens, which may outlive both cookies.

Logging out properly means ending the right layers, in the right apps. Here are the standards for it.

RP-initiated logout: "log me out of here and the IdP"

OpenID Connect RP-Initiated Logout is what most apps should implement first. When the user clicks "Log out":

1. The app clears its own session.
2. It redirects the browser to the IdP's end_session_endpoint (from the discovery document) with:
   • id_token_hint: the ID token it received at login, so the IdP knows which session to end,
   • post_logout_redirect_uri: where to send the user afterwards, which must be registered with the IdP, and
   • optionally state, echoed back.
3. The IdP ends its session (asking for confirmation if the hint is missing) and redirects back.

This fixes the "log in again without a password" problem. It doesn't, on its own, tell the other apps.

Back-channel logout: telling the other apps, server to server

OIDC Back-Channel Logout lets the IdP notify every app the user signed in to during that session:

• Each app registers a backchannel_logout_uri.
• When the IdP session ends, the IdP POSTs a signed logout token (a JWT with the user's sub, the session ID sid and a logout event) directly to each app's backend.
• The app verifies the signature, finds sessions with that sid or sub, and deletes them.

Because it's server to server, it works even if the user closed the other tabs, and isn't blocked by browser privacy features. The app does need to keep a lookup from session ID to its own sessions, and its endpoint must be reachable from the IdP.

Front-channel logout: telling the other apps through the browser

OIDC Front-Channel Logout does the same through the browser: the IdP renders a page with a hidden iframe for each app's frontchannel_logout_uri, and each iframe clears that app's cookie.

It's simpler for apps without a reachable backend, but modern browsers increasingly block third-party cookies in iframes, which makes it unreliable. Prefer back-channel where you can.

SAML Single Logout (SLO)

SAML has its own Single Logout profile. The app (service provider) or IdP sends a LogoutRequest to each party in the session, usually by browser redirect or POST, and each answers with a LogoutResponse. It works, but it's fragile: one app that doesn't answer can break the chain, and many SaaS apps don't implement it at all. Treat SAML SLO as best effort and keep app session lifetimes short.

Don't forget tokens

Ending cookies doesn't invalidate tokens already issued:

• Refresh tokens should be revoked (the IdP's revocation endpoint, RFC 7009, or by the IdP itself when the session ends).
• Access tokens that are JWTs stay valid until they expire. Keep them short-lived (minutes), or have APIs check with the IdP (token introspection) for sensitive operations.

Which should you use?

How Casdoor does it

Casdoor implements:

• RP-initiated logout at /api/logout, with id_token_hint, post_logout_redirect_uri (checked against the application's redirect URLs), client_id and state.
• Back-channel logout: when a session ends, Casdoor sends signed logout tokens to the applications that registered a back-channel logout URI.
• SAML Single Logout to the SAML applications in the session.
• Single sign-out (/api/sso-logout): end every session and token of a user across all applications of an organization at once, or only the current session, with a notification to each app.

Learn more on the SSO page, or run it on Casdoor Cloud from $24/month billed yearly.

FAQ

Why am I logged straight back in after logging out? The app ended its own session but not the IdP's. Implement RP-initiated logout so the IdP session ends too.

Does logging out revoke the access token? Not by itself. Either the IdP revokes tokens when the session ends, or the token stays valid until it expires; keep lifetimes short.

Front-channel or back-channel? Back-channel, if your app has a backend the IdP can reach. Front-channel depends on third-party cookies in iframes, which browsers are phasing out.