Sessions
Back-channel logout
An OpenID Connect mechanism where the provider notifies applications server-to-server that a session has ended.
What Back-channel logout means
Back-channel logout (OpenID Connect Back-Channel Logout 1.0) lets an identity provider tell each relying party, by a direct server-to-server POST of a signed logout token, that a user's session has ended — so the application can end its own session even if the user's browser is closed.
Defined in: OpenID Connect Back-Channel Logout 1.0.
How it works
The logout token is a JWT containing iss, aud, iat, jti, an events claim identifying it as a logout, and a sid and/or sub. It must not contain a nonce, which distinguishes it from an ID token.
Unlike front-channel logout, it does not depend on browser iframes and third-party cookies, which modern browsers increasingly block.
The mistake people actually make
Accepting the logout token without the same validation as an ID token — signature, issuer, audience — which lets anyone log your users out.
Related terms
Session revocation
Ending an active session so that subsequent requests fail, rather than waiting for a token to expire.
OpenID Connect (OIDC)
An identity layer on top of OAuth 2.0 that lets an application verify who a user is, not just what it may access.
ID token
A signed JWT from an OpenID Connect provider carrying verifiable claims about the authenticated user.
Building on any of this?
Tell us what you're putting together. We'll tell you plainly whether Authreads fits it.