RP-Initiated Logout

OpenID Connect RP-Initiated Logout 1.0 (RP-Initiated Logout) lets a relying party (your application) end a user's session at the OpenID Provider. ThunderID implements it as the end_session_endpoint at GET/POST /oauth2/logout. When your application signs a user out locally, it redirects the browser to this endpoint so ThunderID also terminates the Single Sign-On session it established, and then returns the user to a page you choose.

Signing out of your application alone leaves the ThunderID session intact, so the next sign-in reuses it and the user is not prompted. RP-Initiated Logout closes that gap: it ends the session at ThunderID too, so the next sign-in authenticates the user again.

How It Works

1. Your application clears its own session, then redirects the browser to /oauth2/logout.
2. ThunderID validates the request: it resolves the client from the id_token_hint or client_id, and checks any post_logout_redirect_uri against the client's registered list.
3. ThunderID runs the application's sign-out flow to terminate the SSO session and clear the per-flow session cookie. Depending on how the flow is built, this step may prompt the user to confirm the sign-out first.
4. ThunderID redirects the browser to post_logout_redirect_uri, appending state when the application supplied it. If the application supplied no redirect URI, the browser lands on the default ThunderID sign-out page.

Whether the user is asked to confirm depends on the sign-out flow. ThunderID flags a request that carries no id_token_hint as needing confirmation, and the sign-out flow decides what to do with that signal. The default sign-out flow ends the session without prompting, which is the path the diagram above shows. The built-in Conditional Confirmation template prompts only when the hint is absent, and Confirm & Sign Out prompts on every request.

How ThunderID Implements It

Aspect	Behavior
Endpoint	GET/POST /oauth2/logout
Discovery	Advertised as end_session_endpoint in /.well-known/openid-configuration, see Server Metadata
Session termination	Runs the application's sign-out flow, which ends the SSO session and clears the per-flow cookie, see Sessions and Single Sign-On
id_token_hint	Optional. When supplied, its signature and issuer are verified; expiry is not enforced, so an expired ID token is accepted. When omitted, the request is flagged as needing confirmation, which a sign-out flow can branch on
Redirect validation	post_logout_redirect_uri must match one of the client's registered postLogoutRedirectUris exactly. Registered wildcard patterns also match when the server sets allow_wildcard_redirect_uri to true, which is off by default
Sign-out flow	Resolved in order: the flow the application pins, then the default on its organization unit, then the server-level default

Request Methods

The endpoint accepts the same request as either an HTTP GET or an HTTP POST, carrying the same parameters:

• GET carries the parameters in the query string. This is the usual choice, because signing out is a browser redirect to the endpoint.
• POST carries the parameters in an application/x-www-form-urlencoded body. Use it when the id_token_hint would make the URL too long, or to keep it out of the URL and browser history. Note that a request body can still be recorded by applications, proxies, or middleware, so treat id_token_hint as sensitive and redact it from logs.

Request Parameters

Parameter	Required	Description
id_token_hint	Recommended	An ID token that ThunderID previously issued to this client. It identifies the client whose session is ending. The token may be expired. When omitted, ThunderID flags the request as needing confirmation, and the sign-out flow decides whether to prompt.
client_id	Optional	The client that is signing out. Used when id_token_hint is absent, and at least one of the two must be present. When both are present, the client_id must match the client in id_token_hint.
post_logout_redirect_uri	Optional	Where to send the browser after sign-out. Must exactly match one of the client's registered postLogoutRedirectUris.
state	Optional	An opaque value ThunderID appends to post_logout_redirect_uri on the return, when supplied, for your application to correlate the response.

Validation Rules

ThunderID rejects the request with 400 Bad Request when:

• post_logout_redirect_uri does not exactly match a URI registered on the client.
• id_token_hint is present but was not signed by ThunderID or carries a different issuer.
• both id_token_hint and client_id are present and identify different clients.
• neither id_token_hint nor client_id is supplied.
• the client id, whether supplied as client_id or derived from id_token_hint, does not resolve to a registered client.

Configure Your Application

Sign-Out Flow

ThunderID terminates the SSO session by running the application's sign-out flow. The flow is resolved in three steps, and the first match wins:

1. The sign-out flow pinned on the application under its Flows tab.
2. The default sign-out flow set on the application's organization unit, under Organization Units → the organization unit → Flows.
3. The server-level default sign-out flow.

ThunderID ships a server-level default, so an application that pins nothing still signs users out. To use a custom flow instead, build one and select it under the application's Flows tab. See Build a Sign-Out Flow.

Register Post-Logout Redirect URIs

For ThunderID to return the browser to your application, the post_logout_redirect_uri you send must be registered on the application under postLogoutRedirectUris. Configure it through the application's OAuth configuration in a declarative configuration or through the /applications API, see API Reference.

postLogoutRedirectUris:
  - https://app.example.com/signed-out

Try It in ThunderID

Redirect the browser to the endpoint when the user signs out of your application:

GET /oauth2/logout
  ?id_token_hint=$ID_TOKEN
  &post_logout_redirect_uri=https://app.example.com/signed-out
  &state=xyz

The same request as a POST sends the parameters in the body instead:

POST /oauth2/logout
Content-Type: application/x-www-form-urlencoded

id_token_hint=$ID_TOKEN&post_logout_redirect_uri=https://app.example.com/signed-out&state=xyz

ThunderID ends the SSO session and redirects the browser to:

https://app.example.com/signed-out?state=xyz

Related Guides

• Sessions and Single Sign-On, the session model that logout terminates
• Single Sign-On for Flows, how a session is established in the first place
• Build a Sign-Out Flow, the flow that RP-Initiated Logout runs
• OpenID Connect, the identity layer these tokens come from
• Server Metadata, the /.well-known/openid-configuration document that advertises the endpoint