Front-Channel Logout

Front-channel logout lets ProAuth notify relying party applications through the user's browser when a ProAuth browser session ends. ProAuth renders hidden iframes for client applications that participated in the same OP session and have a front-channel logout URI configured.

Configure the client application with:

Setting	Description
frontchannel_logout_uri	Absolute HTTP(S) endpoint loaded by the browser in a hidden iframe. The URI must not contain a fragment.
frontchannel_logout_session_required	When enabled, ProAuth includes the client only when a sid is available. New interactive OIDC sessions include a sid.

Logout Request

For every active client application with frontchannel_logout_uri, ProAuth appends these query parameters:

Parameter	Description
iss	The ProAuth issuer for the tenant.
sid	The OP session identifier from the ID token.

Existing query parameters on the configured URI are preserved. If the configured URI already contains iss or sid, ProAuth replaces those values with the authoritative logout values.

Front-Channel vs Back-Channel Logout

Front-channel logout is widely supported and works well for browser-based clients that already handle iframe logout notifications. It depends on the browser loading the client endpoint, so browser tracking protections and third-party cookie restrictions can make it less reliable.

Back-channel logout sends a signed logout_token directly from ProAuth to the client application's server endpoint. Prefer back-channel logout for confidential server-side applications and enterprise single sign-out where delivery reliability matters.

Both mechanisms can be configured on the same client application. When both are configured, ProAuth renders the front-channel iframe and also sends the back-channel logout notification for the same active session.

RP-Initiated Logout

Front-channel logout is triggered during normal RP-Initiated Logout through the ProAuth end-session endpoint. When post_logout_redirect_uri is supplied, ProAuth first renders the hidden iframes and then redirects the browser to the validated post-logout redirect URI, preserving the state parameter.