Skip to content

spec: Document rp-initiated logout in oidc spec#5801

Open
tung2744 wants to merge 2 commits into
authgear:mainfrom
tung2744:dev-3642
Open

spec: Document rp-initiated logout in oidc spec#5801
tung2744 wants to merge 2 commits into
authgear:mainfrom
tung2744:dev-3642

Conversation

@tung2744

@tung2744 tung2744 commented Jul 3, 2026

Copy link
Copy Markdown
Contributor

ref DEV-3642

@tung2744

Copy link
Copy Markdown
Contributor Author
  1. Document that we cannot completely avoid id_token to appear on the url as it is a known oidc weakness. We will use POST in our SDK and avoid logging the query parameter in our server logs. And allow user to remove PII using hooks as a last resort.
  2. We want to document the error behavior of post_logout_redirect_uri, which is a legacy behavior. And it should be documented as api debts

The end_session_endpoint silently falls back to the Settings page on
an invalid post_logout_redirect_uri instead of returning an error.
Document this as intentional API debt kept to avoid a breaking change,
not the ideal behavior.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
@tung2744

Copy link
Copy Markdown
Contributor Author

For 1 it is documented already. Added a commit for 2.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants