A session ended at the identity provider stays valid in the console for up to five minutes #7

New Issue

2026-09-21T07:18:04Z

cgalo5758 commented

2026-09-21 07:18:04 +00:00

What a person cannot do today

End every console session at once by signing out at the identity provider. The console re-checks a session against the provider every five minutes, so a session the provider has ended keeps working until its next check.

What they should be able to do

Have the console end the session within seconds of the provider ending it, for the events the provider reports.

Why it matters

Five minutes is the bound today, and for most deployments it is fine. For a deployment that revokes access in a hurry, the gap is real, and OpenID Connect defines a way to close it: the provider posts a logout token to the console, which ends the matching sessions.

Where

internal/auth, beside the periodic identity refresh.

Done when

The console exposes a back-channel logout endpoint, registers it in the provider setup doc as optional, and ends the sessions a logout token names; the five-minute refresh stays as the fallback for providers that do not send one.

Migrated from status/issues.md at b7a0e15

## What a person cannot do today End every console session at once by signing out at the identity provider. The console re-checks a session against the provider every five minutes, so a session the provider has ended keeps working until its next check. ## What they should be able to do Have the console end the session within seconds of the provider ending it, for the events the provider reports. ## Why it matters Five minutes is the bound today, and for most deployments it is fine. For a deployment that revokes access in a hurry, the gap is real, and OpenID Connect defines a way to close it: the provider posts a logout token to the console, which ends the matching sessions. ## Where [`internal/auth`](https://git.coopcloud.tech/wiki-cafe/member-console/src/commit/b7a0e15/internal/auth), beside the periodic identity refresh. ## Done when The console exposes a back-channel logout endpoint, registers it in the provider setup doc as optional, and ends the sessions a logout token names; the five-minute refresh stays as the fallback for providers that do not send one. Migrated from status/issues.md at b7a0e15

cgalo5758 added the

kind

enhancement

area/identity security labels 2026-09-21 07:18:04 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: wiki-cafe/member-console#7