implementing-fsa-logout

A secure OIDC logout flow clears local session cookies and redirects the browser to the provider's logout endpoint to invalidate the server session. This prevents lingering cookies and ensures the authenticated session is fully terminated.

You clear session cookies by exposing a GET /logout route that reads the idToken, builds the Scalekit /oidc/logout URL with an id_token_hint, clears local cookies, and redirects the browser to invalidate the Scalekit session.

Yes, this cross-stack logout approach works with Python Flask, Node.js Express, Go Gin, and Java Spring Boot. It provides implementation templates for cookie-based session management and post-logout redirects across these frameworks.

An allowlisted post_logout_redirect_uri is required to navigate users back to a safe URL after logout. You must configure this redirect URI in the Scalekit dashboard to ensure the post-logout destination is trusted and secure.

Your web app logout is not ending the provider session because it only clears local cookies without browser delegation. You must redirect to Scalekit's /oidc/logout endpoint to ensure the Scalekit session is properly invalidated.

Yes, you need the idToken to generate a valid /oidc/logout URL. The logout route reads the idToken before clearing cookies to supply the id_token_hint parameter, which securely links the logout request to the active session.