Disable Logout Consent Prompt with OIDC Endpoint

Knowledge Articles
1

Overview

This article explains why a consent prompt may appear when logging users out with the /oidc/logout endpoint and provides methods to bypass this behavior for specific use cases.

Applies To

  • OpenID Connect (OIDC) Logout
  • Consent Prompt

Cause

This behavior adheres to the OpenID Connect (OIDC) standard, which specifies that a user should provide permission before being logged out of the Identity Provider.

Solution

The logout consent prompt can be bypassed using one of the following two methods:

  1. Disable the prompt at the tenant level.
    1. Navigate to Dashboard > Settings > Advanced.
    2. Select the Login and Logout tab.
    3. Clear the RP-Initiated Logout End-User Confirmation checkbox.
  2. Avoid triggering the conditions for the consent prompt. The prompt is enforced when any of the following conditions are met:
    • Neither the id_token_hint nor the logout_hint parameters are provided.
    • The ID token’s sid claim does not correspond to the browser session in the request.
    • The value of the logout_hint parameter does not match the current session data.

For more details, refer to the documentation on the Logout Consent Prompt.