v26.3.17
v26.3.17
End Ory sessions when the upstream OpenID Connect provider signs the user out
Social sign-in providers can now end the Ory session they created, using
OpenID Connect Front-Channel Logout 1.0. Set
front_channel_logout: true on the provider, and register
https://<your-ory-domain>/self-service/methods/oidc/frontchannel-logout/<provider-id> as that provider's front-channel logout
URL with frontchannel_logout_session_required enabled. Each provider has its own logout URL, and can only end sessions created
through itself. When the user signs out at the provider, Ory revokes the session that sign-in created.
The provider must return the sid claim in the ID token, and the provider's claims_source must be id_token (the default). The
mechanism relies on third-party cookies and therefore only works in browsers that still allow them. Nothing changes for providers
that leave front_channel_logout unset, and the Ory session cookie's own SameSite behavior is unchanged.