Add last logout date/time to JWT claims

[rueben.tiow]

Hi @josh.young,

Welcome to the Auth0 Community!

@josh.young

Is there a way to attach actions to logout?

I’d like to save the last logout date as a JWT claim to allow invalidation of the JWT immediately (or soon thereafter) on logout. This is to address the security concern around session expiration.

Unfortunately, we currently do not support a Post-Logout Action and there isn’t a last_logout user profile attribute. With that said, I believe this would be a great candidate for a feedback request. If you have a moment, I recommend creating a feedback request asking to support a Post Logout Action.

Now, it may be possible to leverage your Auth0 Logs to find the slo Log Event to determine if the access token is valid when compared to the logout time. However, there isn’t an easy way to accomplish this without some heavy lifting on your end.

With that said, my best recommendation is to make the access token expiration as short-lived as possible.

Please check out this related Community Post regarding invalidating access tokens when a user logs out.

Let me know if I can help you with anything else.

Thanks,
Rueben