← All practicals

Single Logout

End one browser session and watch every relying party get told.

1. 1

   Sign in to the Demo app, then click “Sign out everywhere”.

   This drives the real end_session_endpoint (/oidc/logout) — RP-Initiated Logout 1.0 — with the ID token you just received as id_token_hint. It is a browser navigation, not a background call, and that is the point: the Lab mints one OP session (sid) per app, so the hint ends THIS app’s session, while your Lab session cookie riding along is what makes the Lab sweep every other relying party you had signed into. An app holding your ID token but no browser session can only sign you out of itself.

2. 2

   Watch the Lab verify the hint, then fan out a logout_token.

   OIDC Back-Channel Logout 1.0: the Lab mints a fresh, single-use ES256 JWT for the demo RP's own registered backchannel_logout_uri and POSTs it — no browser round trip, no third-party-cookie dependency. (This demo RP lives inside the same Worker as the Lab, so if that POST to our own hostname is refused the token is handed to the receiver in-process instead — same route, same checks. /demo tells you which happened; a real, separate RP always gets the HTTP POST.)

3. 3

   See the demo RP verify the delivered token and reflect it back.

   The receiver checks signature, issuer, audience, the backchannel-logout events claim, that there is NO nonce, and a fresh, single-use jti — exactly what a real relying party must do before trusting a server-to-server logout.