Learn how OIDC back-channel logout works and why it is important in modern identity solutions.
Ensuring user security and privacy is a topic that never gets old. Nowadays social sign-in has been widely adopted as a sign-in method, for its simplicity and seamless experience. However, what happens if you logout from the social identity provider, can your other online services using your social identity be logged out at the same time?
One essential feature of OpenID Connect (OIDC), the back-channel logout, offers a robust solution to address this requirement, enhancing user security by enabling logout simultaneously across various applications.
OIDC back-channel logout is a mechanism designed to ensure that when a user logs out from an identity provider (IdP), they are also logged out from all the associated relying parties (RPs) or applications.
The back-channel logout operates through direct server-to-server “back-channel” communication, allowing the identity provider to notify all registered client applications about the user's logout event. Consequently, client applications can promptly terminate the user's sessions and perform any necessary cleanup actions.
The back-channel logout process involves several steps:
The back-channel logout feature offers several benefits for both users and service providers:
We are actively testing this feature recently, and it will be available on both Logto Cloud and Logto open-source version. Please stay tuned to our future updates.
OIDC back-channel logout is an essential feature in modern identity solutions, enabling users with greater control over their online security and privacy. By adopting this mechanism, organizations can provide a seamless and secure logout experience, safeguarding their online activities.