How to implement OIDC back-channel logout, and why almost nobody has
Blog post from WorkOS
OpenID Connect Back-Channel Logout, finalized in 2022 and updated with errata in December 2023, enables identity providers to notify applications server-to-server when a user session should end, such as after central logout or account deactivation. Providers advertise support, applications register a reachable logout endpoint, and the provider POSTs a signed logout JWT containing required claims and either a session identifier, user identifier, or both. Applications must rigorously validate the token’s signature, issuer, audience, expiration, logout event, prohibited nonce, and replay identifier, then respond idempotently while preventing cached responses. The principal implementation challenge is not the endpoint itself but maintaining a server-side mapping between the provider’s session ID and local sessions, allowing the application to revoke session records, relevant refresh tokens, and possibly manage still-valid access tokens without relying on browser cookies. Adoption remains limited because endpoints must accept inbound requests from every supported provider and because many applications lack session infrastructure capable of immediate invalidation. Back-channel logout addresses central logout and account disablement but not broader mid-session signals such as role changes or device posture, which Continuous Access Evaluation Protocol can provide where available; consequently, shorter session lifetimes, storing session IDs at login, and implementing invalidatable server-side sessions are presented as practical preparatory steps.
No tracked trend matches for this post yet.
Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.