Skip to main content

RP-Initiated Logout (OpenID Connect RP-Initiated Logout 1.0 §2)

GET 
/oauth2/logout

Signs this browser out: deletes every refresh family under its session, the session and its cookie, then redirects to post_logout_redirect_uri. When the identity provider has its own sign-out, the browser goes there first and comes back through /oauth2/logout/done.

  • Must be a top-level navigation; a fetch does not carry the SameSite=Lax session cookie.
  • post_logout_redirect_uri must exactly match one registered for the client. Otherwise it is ignored and the response is 200 Signed out.; the sign-out still happens.
  • Access tokens already issued stay valid until they expire (up to an hour).

Request​

Responses​

Signed out, with nowhere validated to return to. Clears the session cookie.