The back-channel logout

Help
,
1

Started to investigate the back-channel logout functionality: OIDC Back-Channel Logout

A few questions.

Is it possible to make the back-channel logout otional? I.e. normally users would logout only from the application they are using. In case they wish they can do a global logout and kill all sessions in all apps?

Which leads to next question and the sid in the logout token. Would that sid be the same only in the same browser where the auth0 session is? Can you implement a “global” logout which would kill the sessions across all devices? E.g. user request a “hard” logout in desktop browser and it should send the back channel logout also to a backend of a mobile app (which he has logged in a mobile device and the auth0 sid is different I guess?).

2

Did some more testing and it seems in fact that only the apps that share the same Auth0 session id receive the back-channel logout request (aka basically applies to the different tabs where user has signed in to different apps in same browser session).

Note: tested this by logging out with the /v2/logout end point. Not actually sure if that is correct and tests what I thought I did.

Is there any way to initiate a “global” logout from all users sessions so all apps where user has logged in would receive the back-channel notification?

(Does not need to be that user is actually logged in to an app but could be just all the apps which have the back-channel logout uri configured).

Or would this kind of behaviour require custom handling?