Protocols and how-tos
Logout in OpenID Connect: RP-initiated, front-channel and back-channel
Why signing out is harder than signing in, how RP-initiated and back-channel logout work, and how to make revocation reach every application.
The short answer
OpenID Connect defines separate logout mechanisms because there are separate sessions. RP-initiated logout lets your application send the user to the provider to end the provider session. Back-channel logout lets the provider notify your server directly, with a signed logout token, when a session ends elsewhere. Front-channel logout does the same through hidden browser iframes, and is increasingly unreliable because browsers block third-party cookies.
Sources last reviewed .
RP-initiated logout
Your application ends its own session, then redirects to the provider's end_session_endpoint with id_token_hint and a registered post_logout_redirect_uri (OpenID Connect RP-Initiated Logout 1.0). Without this second step the provider session survives, and the next 'sign in' completes silently as the same user — a classic shared-computer problem.
Back-channel logout
When a session ends at the provider — user sign-out, administrator revocation, expiry — the provider POSTs a logout token to each relying party's registered back-channel URI (OpenID Connect Back-Channel Logout 1.0). The logout token is a signed JWT with an events claim and the sid or sub to end. The relying party validates it like an ID token, must reject one containing a nonce, and must end the matching local sessions.
Because it is server-to-server, it does not depend on the user's browser being open, which is what makes it suitable for revocation.
Designing for it
- Store the provider's sid against your local session so a logout token can find it.
- Make your back-channel endpoint idempotent; providers retry.
- Remember that tokens already issued remain valid until they expire unless your APIs check session state. Logout ends sessions, not every token in flight.
In Authreads
How this applies to Authreads
RP-initiated logout with registered post-logout redirect URIs is Available. Back-channel logout support is documented in the developer portal; check it for current status before relying on it.
Authreads is a multi-tenant identity platform in beta. Capability status is maintained on /roadmap as Available, In progress or Planned.
Keep reading
Building on any of this?
Tell us what you're putting together. We'll tell you plainly whether Authreads fits it.