Skip to content

Added back channel logout endpoint without context#4704

Merged
shepilov merged 11 commits intomasterfrom
feat/backchannel-logout-without-context
Mar 24, 2026
Merged

Added back channel logout endpoint without context#4704
shepilov merged 11 commits intomasterfrom
feat/backchannel-logout-without-context

Conversation

@shepilov
Copy link
Copy Markdown
Contributor

The previous design had three practical problems:

  • The provider had to know stack’s internal OIDC context name to call back channel logout.
  • When sid was available, stack could still end up logging out more than the current OIDC session

With this PR:

  • Cozy now supports POST /oidc/logout in addition to the existing POST /oidc/:context/logout
  • context is resolved server-side from the logout token and existing sid bindings
  • local browser sessions are bound to OIDC sid
  • OIDC-derived OAuth clients are also bound to OIDC sid
  • backchannel logout can revoke both bound browser sessions and bound OAuth clients
  • the existing contextful endpoint remains supported

@shepilov shepilov requested a review from a team as a code owner March 20, 2026 16:56
@shepilov shepilov force-pushed the feat/backchannel-logout-without-context branch 4 times, most recently from 8f9301e to 1200bcf Compare March 23, 2026 19:16
Comment thread web/oidc/oidc.go Outdated
Comment thread web/oidc/oidc.go Outdated
Comment thread web/oidc/oidc.go Outdated
Comment thread web/oidc/oidc.go Outdated
Comment thread model/oauth/client.go Outdated
Comment thread model/session/oidc_sessions.go
@shepilov shepilov force-pushed the feat/backchannel-logout-without-context branch from 1200bcf to 3005b31 Compare March 24, 2026 11:22
@shepilov shepilov force-pushed the feat/backchannel-logout-without-context branch from de9166b to 6441b5f Compare March 24, 2026 12:29
@shepilov shepilov merged commit 2cae26d into master Mar 24, 2026
4 checks passed
@shepilov shepilov deleted the feat/backchannel-logout-without-context branch March 24, 2026 17:23
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants