是否可以从我的后端注销 wso2is？

Question

Are there another ways of doing logout without redirecting my Frontend to oidc/logout page (it works fine,but isn't it insecure sending idToken and my IDP url to frontend ),i have separate front and back end. Like in Keycloak which invalidates session by sending refreshToken ? If not,what is a right way of doing logout in my application?

Answer 1

We are sending the ID_Token in POST request directly to the IS Server thus it should not have any security concerns. Using ID_Token as id_token_hint while doing a logout is coming from OIDC specification[1]. This will prevent attackers from logging out users from their accounts because only the real RP can present the valid ID Token.

If you want an alternate way to logout you can make use of session management API[2]. But it is recommended to use the logout endpoint.

[1] https://openid.net/specs/openid-connect-session-1_0.html#RPLogout [2]https://is.docs.wso2.com/en/5.9.0/develop/session-mgt-rest-api/