[PiquelChips]

An app's logout could leave the user signed in, or not work at all. A passkey sign-in on the app's own page has no cookie at auth, so RP-initiated logout ended nothing and the session lived on for 30 days. An id_token_hint auth couldn't verify refused the whole logout as JSON. The ID token sat in the logout page's URL, and both SDKs put it there. Back-channel URIs that auth can never reach, like http://127.0.0.1, registered, and deleted apps still received logout tokens.

Now:

• Inline sessions end. Confirming the logout also ends the session the hint's sid names, if it's the hinted account's.
• Nothing blocks logout. A hint auth can't verify is ignored: the user can still sign out, the request names no app, and the browser stays on auth instead of going to the redirect URI. The confirmation page says so, and also says when the hint names a different account from the one signed in.
• No ID token in URLs. /oidc/logout, by query or form, now answers the confirmation page itself instead of redirecting to /logout with every parameter in the address. The page carries the request as hidden form fields, posts them to /logout, and auth validates them again there, so nothing is stored between the two steps. Both SDKs replace logout_url/logoutUrl with logout(...), a LogoutRequest the browser posts as a form: page() for server apps (the login routes now answer with it), and the browser client posts it itself. /logout with no parameters still signs out of auth itself, from the settings or the dashboard.
• Reachable back-channel URIs. They get their own type, BackchannelLogoutUri: HTTPS, and a public address when the host is an IP. The CLI, console and dashboard all validate through it. Deleted clients are left out of logout deliveries.

Tests cover each case: the confirmation page by query and by cross-site form, the inline session, the unverifiable hint, the other account's hint, the deleted client, the URI rules (doc tests), and both SDKs' posted requests. The OIDC reference, SDK guides, app settings and architecture docs describe the new flow.

I didn't add a shared SDK vector for the logout request: building one needs a validated ID token in each SDK's runner, so each SDK has a unit test of the posted fields instead.

Stacked on #522.

Closes #280

Note

Written by Claude Opus 5.5 in Claude Code (via T3 Code)

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 26 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: f90c9f41-6a34-4f9b-b56f-33ef527e761b

Commits

Reviewing files that changed from the base of the PR and between 74b5994 and 054cece.

Files selected for processing: 39

• apps/auth-service/src/cli/client.rs
• apps/auth-service/src/oidc/logout.rs
• apps/auth-service/src/oidc/mod.rs
• apps/auth-service/src/oidc/tests/logout.rs
• apps/auth-service/src/oidc/tests/mod.rs
• apps/auth-service/src/oidc/tests/sdk_client.rs
• apps/auth-service/src/oidc/tests/sdk_routes.rs
• apps/auth-service/src/oidc/tests/tokens.rs
• apps/auth-service/src/security/endpoint.rs
• apps/auth-service/src/web/auth/oidc.rs
• apps/auth-service/src/web/mod.rs
• apps/auth-service/src/web/tests.rs
• crates/auth-sdk/src/axum/login/routes.rs
• crates/auth-sdk/src/axum/tests/login.rs
• crates/auth-sdk/src/axum/tests/sessions.rs
• crates/auth-sdk/src/client.rs
• crates/auth-sdk/src/lib.rs
• crates/auth-sdk/src/tests.rs
• crates/common/src/clients/mod.rs
• crates/database/.sqlx/query-157d808cbe97493724eceb7c4354fd0b28cd0e00f3dffe4007e391f254360e0e.json
• crates/database/src/repositories/oidc/clients.rs
• crates/database/src/repositories/oidc/mod.rs
• crates/ui/src/lib.rs
• crates/ui/src/oidc.rs
• docs/dev/architecture/oidc.md
• docs/dev/architecture/sdk.md
• docs/dev/operations/clients.md
• docs/user/apps/app-settings.md
• docs/user/apps/back-channel-logout.md
• docs/user/apps/sign-in-rust.md
• docs/user/apps/sign-in-typescript.md
• docs/user/reference/oidc.md
• packages/auth/src/browser.ts
• packages/auth/src/client.ts
• packages/auth/src/index.ts
• packages/auth/src/login.ts
• packages/auth/src/platform.ts
• packages/auth/test/browser.test.ts
• packages/auth/test/server.test.ts

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn