Overview
ISO/IEC 26136:2024 - Information technology - OpenID Connect - OpenID Connect front‑channel logout 1.0 defines a front‑channel logout mechanism for OpenID Connect 1.0 (built on OAuth 2.0). The standard specifies how an OpenID Provider (OP) can notify Relying Parties (RPs) to clear a user’s local session by rendering RP logout URIs in the End‑User’s User Agent (browser) - typically using iframes and HTTP GETs - without requiring an OP iframe on RP pages.
Key topics and technical requirements
- Front‑channel logout flow: OP constructs a page that renders RP logout endpoints (frontchannel_logout_uri) in tags to trigger RP logout actions via the User Agent.
- Registered logout URI: RPs register a frontchannel_logout_uri (absolute URI). The domain, port and scheme must match a registered Redirection URI; fragments are disallowed and existing query components must be preserved.
- Optional parameters: OPs MAY append iss (issuer) and sid (session ID) query parameters. If one is included, both MUST be included. RPs MAY validate iss/sid against ID Token claims.
- Session identifier (sid): Registered as a JWT claim; a string that uniquely identifies a session for an issuer. Implementations MUST ensure sufficient entropy to prevent guessing.
- HTTP and caching: RP logout responses SHOULD include
Cache-Control: no-store to avoid cached responses interfering with future logout requests.
- Discovery and registration metadata: IANA-registered metadata and client registration fields include:
- frontchannel_logout_uri
- frontchannel_logout_session_required
- frontchannel_logout_supported
- frontchannel_logout_session_supported
- sid claim registration
- Implementation considerations: Browsers’ third‑party tracking prevention may block access to third‑party cookies and storage inside iframes. The standard recommends defensive detection and user notification when front‑channel logout cannot clear RP state.
Applications and who should use it
- Identity and access management architects implementing Single Sign‑Out across multiple web applications.
- OpenID Providers (OPs) that need a browser-based method to signal logout to many Relying Parties in parallel.
- Relying Parties (RPs) that want to support OP-initiated logout without embedding OP iframes on their pages.
- Useful in federated SSO deployments, enterprise identity platforms, and SaaS ecosystems where coordinated logout across services is required.
Related standards
- OpenID Connect Core 1.0 (identity layer on OAuth 2.0)
- OpenID Connect Back‑Channel Logout 1.0 (server-to-server logout)
- OpenID Connect RP‑Initiated Logout 1.0
- OpenID Connect Discovery 1.0 and Dynamic Client Registration 1.0
Keywords: OpenID Connect, front‑channel logout, OAuth 2.0, session ID, frontchannel_logout_uri, RP, OP, single sign‑out.