generic-oidc-logout-id-token-hint

Keycloak rejects ASP.NET Core logout requests when the id_token_hint parameter is missing. Reusing the stored provider-issued ID token as an id_token_hint during the logout redirect finalizes the session termination securely.

To implement OIDC RP-initiated logout in ASP.NET Core, configure your authentication properties to persist the ID token and pass it as an id_token_hint parameter during the logout redirect process.

You need to pass an id_token_hint during OIDC logout when your identity provider requires strict session validation. This ensures users are signed out of both the application and the provider simultaneously.

Yes, this approach maintains strict validation for issuers, audiences, and redirect URIs. It safely reuses the provider-issued ID token while preventing token exposure and security drift during the logout flow.

Yes, this method applies to generic OIDC providers in ASP.NET Core workflows. It handles robust session termination for any provider requiring an id_token_hint, ensuring secure token handling across platforms.

Relying on stored ID tokens requires persisting the token throughout the session, which necessitates strict validation to prevent token exposure. If the token is missing, providers like Keycloak will reject the logout request.