Single logout across multiple appilications

There indeed is only one endpoint you can call for Auth0. That clears the Auth0 SSO session. However, there’s no way for Auth0 to let your applications know they need to log out the current user (unless you’re using SAML, which does have single logout support built in, but I’m gonna assume we’re talking about OAuth 2 or OpenID Connect here).

After sending your users to the Auth0 logout endpoint, you can have Auth0 redirect them somewhere else. That’s what I was talking about: a page hosted by you that calls all your applications through hidden iframes to force a logout on every single one of them.

You can also do it the other way around, with checkSession, but that would only check the session every say 15 minutes (depends on what interval you use in your code, but Auth0 recommends at least 15 minutes to prevent running into rate limiting). I’d say the first method of forcing a logout on every application is clearer to your users.

2 Likes