Documentation/Developers
Back
  • Getting started
    • Frontends and app types
    • Environments and endpoints
  • OAuth clients
    • Client ID and secret
    • Redirect URIs and start URL
    • Secret rotation
  • Login with appsolut
    • Authorization code flow
    • Tokens and claims
    • Frontend role
    • Sign-out
    • Revocation and issued tokens
    • Token endpoint errors
  • Frontend keys
    • Issue and store a key
    • Send a key
    • Rotate and revoke
  • Members API
    • Eligibility from a backend
    • The signed-in member
    • Results, rate limits and errors
    • Is an applicant an eligible member?
    • The signed-in frontend user's membership
  • appsolut register API
    • Implement the API
    • Connect and test
    • Verify a member with their challenge code
    • List every member
    • The status of several members
    • The status of one member
    • The person data of several members
    • The person data of one member
    • The claims of several members
    • The claims of one member
    • Health check

Sign-out

Signing a frontend user out in two steps, with the sign-out page.

A frontend user stays signed in on the sign-in surface for up to 7 days without use (30 days at most), so the next sign-in from any of the organisation's frontends passes without a password. Your frontend's own logout does not end that session, which is wrong on a shared computer. So a frontend signs a user out in two steps:

  1. End your own session: drop the user's tokens and your session cookie.
  2. Send the browser to the sign-out page, as a top-level navigation (a link or a redirect, not fetch or an iframe):
<studio>/oauth/sign-out?client_id=<your client ID>

The sign-out page

The page, in the organisation's sign-in branding, offers two buttons:

  • "Sign out" ends the session in this browser only. Other frontends' tokens stay valid until they expire; each frontend ends its own.
  • "Sign out of all websites and apps" ends every session of the user at the organisation, on every device: the sign-in surface's sessions and every frontend's OAuth session. From then on, no frontend's refresh token works: treat the refused refresh as signed out. Access tokens already issued stay valid until they expire, at most an hour.

Both buttons return the browser to your frontend's start URL. There are no sign-out URIs: the page takes no return address, so it is no open redirect. Without a session, the page says the user is signed out and links to the start URL.

The page signs nobody out by itself. Each button is a POST from the page, so a link, an image or another site cannot sign a user out; the user always chooses. An unknown client ID, or one of a frontend the sign-in surface does not serve, gets a neutral error page and no redirect.