proposed core.logout

Sign the browser out at an app's request, and send it back to the app

An app sends the browser to /oauth/end-session with an id_token_hint, its client_id, a post_logout_redirect_uri and state, all optional. QAuth checks the hint's signature and issuer and accepts it expired. A return URI must be one the app registered, matched exactly, for the client the hint or client_id names; otherwise QAuth shows an info page, ends nothing and never redirects. When the hint names the account of the browser's session and, by its sid, that session, the session ends at once: its rows, its cookie and its registry rows go, and the session's end reaches the back-channel logout of its apps. In every other case a browser that is signed in gets the logout_confirm step, and nothing ends until the person answers it. The person signs out of this account or of every account on the browser, or stays signed in; either way the browser goes back to the app's registered URI with state, or to the sign-out status page. An app the operator did not set up is never redirected to before the browser has seen a QAuth page: the signed-out page links to its return URI instead.

What this view shows

GET and POST /oauth/end-session from the request to the response; the logout_confirm interaction from its start through the step reads, the answer and the cancel; and GET /oauth/end-session/status.

Open world: what is not drawn here is not ruled out. Only the guarantees below are binding.

Left out of this view:

the checks an answer or a cancel passes before its turn is taken, unchanged from #616: the same origin (403, request.csrf_rejected), the media type (415), the body bound (413), the flow cookie that binds the interaction (410 interaction_expired), the CSRF value of the current step view (403), and the turn (an answer another answer beat gets the step as it now is); a cancel that names anything but its CSRF value is refused with 400
the refusals of the reads: an id that names no live interaction answers 410 interaction_expired; the personal-data read answers 410 without the flow cookie that binds the interaction and 403 from another origin; both reads have their own rate limits (#616)
several accounts on one browser (ADR-019 Decision 3, #548): the session cookie names one session today, so the step lists one account and logout_all ends the same session as logout; once #548 lists several, logout ends only the account the request is for and logout_all every account the cookie lists
the delivery of back-channel logout (core.backchannel-logout, #624): the transaction that ends the session takes its registry rows, the clients it served, and queues one user.client_session_ended event per client, which the delivery role sends to each client that registered a backchannel_logout_uri as a logout token. The event user.signed_out carries the session's sid, so its CAEP session-revoked SET names the user and the session together
refresh tokens: this route revokes none (an app revokes its own at /oauth/revoke before it sends the browser here, ADR-017 F0); POST /auth/logout, core.logout-token, still revokes every one of the user
the realm resolver and the rate limit of the status page, which refuse as those of the end-session route do
a store failure while the request is checked (the client, the session, the user) answers 500 before anything is ended, and a failure to record the event of a refusal turns that refusal into a 500
ui_locales and logout_hint are accepted and not read; a parameter repeated, or longer than its bound, fails the schema
a session cookie that does not verify, or names an ended session, is cleared by the read that finds it so, as every page that reads the cookie clears it, and counts as no session
a browser whose cookie names a later session of the same account when the answer comes: the session the step was started for is the one that ends

The main story

When: The host is a host of an enabled realm that has an issuer, the address is under its end-session limit, the request is a GET, every parameter is given at most once and within its bound; the POST body is a form, an ID token this realm issued: its signature verifies with a key of the realm's token keys (EdDSA or RS256), its iss is the realm's issuer, its typ is an ID token's, and it has not expired, client_id is absent, or it is the valid hint's aud, post_logout_redirect_uri is, exactly, one of the post_logout_redirect_uris of the client the valid hint's aud or client_id names, that client may be used, and the operator set it up (the seed manifest), the browser's session is of the account the valid hint's sub names, the hint's sid is that session's, and the client the hint was issued to is known and may be used, INTERACTION_UI_ENABLED is off (the default): the end-session route draws the step as a plain form, the person signs out of the account the request is for, when the step is answered, the client still registers the return URI and may be used, the session the step was started for is still live when the step is answered.

Wait for an end-session request: GET /oauth/end-session with a query, or POST /oauth/end-session with a form, arrives
Find the realm of the host: the request has its realm
Count the request against the end-session limit: the address is under its limit
Check the parameters against the schema: the parameters pass the schema
Verify the id_token_hint, and accept it expired: the hint is read, or counted as absent
Check client_id against the hint: client_id is absent or matches
Check the return URI against the client's registration: there is no return URI, or it is registered
Find the browser's session: the valid hint names the session's account: no confirmation is asked
End the browser's session: the session is ended
Record the sign-out: the request carries a registered return URI of a client the operator set up

Result: Send the browser back to the app, signed out.

The flow

Show failure paths and “the user closes the page”

blue line: the main storyred dashed line: a failure path (shown with “Show failure paths”)dotted line: decided by a rule, nobody actsdashed grey box: the server decides, nothing is showngreen exit: successred exit: no redirect

What each step answers

Step	The outside world sees
Send the browser to the ceremony page of the confirm step atConfirmCeremony	303 · headers: {"Location":"<issuer>/ui/interaction/<the interaction id, 43 base64url characters>","Set-Cookie":"__Host-qauth_flow=<the browser's interaction secrets, this one's added>; Path=/; HttpOnly; SameSite=Lax","Cache-Control":"no-store"}
Show the confirm step as a plain form showingConfirmPage	200 · headers: {"Content-Type":"text/html; charset=utf-8","Set-Cookie":"__Host-qauth_flow=<the browser's interaction secrets, this one's added>; Path=/; HttpOnly; SameSite=Lax","Cache-Control":"no-store","Content-Security-Policy":"the server-rendered pages' nonce-based policy"} · body: "Sign out?", the account's identifier, the app's display name marked as declared when the request named one, and a form to POST /interaction/v1-rc.0/<id>/answer with csrf and the buttons Sign out (decision logout), Sign out of all accounts (logout_all) and Stay signed in (stay)
Return the confirm step showingStep	200 · headers: {"Content-Type":"application/json; charset=utf-8","Cache-Control":"no-store"} · body: {"step":"urn:qauth:ia:logout_confirm:v1-rc.0","params":"{}","alternatives":"[]","csrf":"the CSRF value of this step view, for one answer","client":"the client display, when the request named a client","brand":"the realm's brand","expiresAt":"when the interaction expires"}
Return the confirm step's personal data showingPersonal	200 · headers: {"Content-Type":"application/json; charset=utf-8","Cache-Control":"no-store"} · body: { accounts: [{ identifier, current: true }] }: the account the session is of, by the identifier it signed in with
Send the browser back to the app, signed out signed_out.returned	303 · headers: {"Location":"post_logout_redirect_uri, with state added to its query when the request had one","Set-Cookie":"__Host-qauth_session=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0, with Secure when SESSION_COOKIE_SECURE is on","Cache-Control":"no-store"}
Send the browser back to the app; it was not signed in nothing_to_end.returned	303 · headers: {"Location":"post_logout_redirect_uri, with state added to its query when the request had one","Cache-Control":"no-store"}
Show that the browser is signed out signed_out.page	200 · headers: {"Content-Type":"text/html; charset=utf-8","Set-Cookie":"__Host-qauth_session=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0, with Secure when SESSION_COOKIE_SECURE is on","Cache-Control":"no-store"} · body: "You are signed out."
Show that the browser is signed out; it was not signed in nothing_to_end.page	200 · headers: {"Content-Type":"text/html; charset=utf-8","Cache-Control":"no-store"} · body: "You are signed out."
Show that the browser is signed out, with a link back to an app the operator did not set up signed_out.offered	200 · headers: {"Content-Type":"text/html; charset=utf-8","Set-Cookie":"__Host-qauth_session=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0, with Secure when SESSION_COOKIE_SECURE is on","Cache-Control":"no-store"} · body: "You are signed out.", the host of post_logout_redirect_uri, and, for an http(s) URI, a link to it with state added when the request had one
Show that the browser is signed out, with a link back to an app the operator did not set up; it was not signed in nothing_to_end.offered	200 · headers: {"Content-Type":"text/html; charset=utf-8","Cache-Control":"no-store"} · body: "You are signed out.", the host of post_logout_redirect_uri, and, for an http(s) URI, a link to it with state added when the request had one
Send the browser back to the app after the person signed out signed_out.confirmed_returned	303 for a form post; 200 for a JSON answer · headers: {"Location":"for a form post, post_logout_redirect_uri with state added when the request had one","Set-Cookie":"__Host-qauth_session cleared when it names the ended session; __Host-qauth_flow without the finished interaction's secret","Cache-Control":"no-store"} · body: for a JSON answer, { result: redirect, location: the same URL }
Send the browser to the status page after the person signed out signed_out.confirmed_page	303 for a form post; 200 for a JSON answer · headers: {"Location":"for a form post, <issuer>/oauth/end-session/status","Set-Cookie":"__Host-qauth_session cleared when it names the ended session; __Host-qauth_flow without the finished interaction's secret","Cache-Control":"no-store"} · body: for a JSON answer, { result: redirect, location: the same URL }
Send the browser back to the app; its session had already ended nothing_to_end.finish_returned	303 for a form post; 200 for a JSON answer · headers: {"Location":"for a form post, post_logout_redirect_uri with state added when the request had one","Set-Cookie":"__Host-qauth_flow without the finished interaction's secret","Cache-Control":"no-store"} · body: for a JSON answer, { result: redirect, location: the same URL }
Send the browser to the status page; its session had already ended nothing_to_end.finish_page	303 for a form post; 200 for a JSON answer · headers: {"Location":"for a form post, <issuer>/oauth/end-session/status","Set-Cookie":"__Host-qauth_flow without the finished interaction's secret","Cache-Control":"no-store"} · body: for a JSON answer, { result: redirect, location: the same URL }
Send the browser back to the app, still signed in to QAuth stayed.returned	303 for a form post; 200 for a JSON answer · headers: {"Location":"for a form post, post_logout_redirect_uri with state added when the request had one","Set-Cookie":"__Host-qauth_flow without the finished interaction's secret","Cache-Control":"no-store"} · body: for a JSON answer, { result: redirect, location: the same URL }
Send the browser to the status page, still signed in stayed.page	303 for a form post; 200 for a JSON answer · headers: {"Location":"for a form post, <issuer>/oauth/end-session/status","Set-Cookie":"__Host-qauth_flow without the finished interaction's secret","Cache-Control":"no-store"} · body: for a JSON answer, { result: redirect, location: the same URL }
Say that the browser is signed out status.signed_out	200 · headers: {"Content-Type":"text/html; charset=utf-8","Cache-Control":"no-store"} · body: "You are signed out."
Say that the browser is still signed in status.signed_in	200 · headers: {"Content-Type":"text/html; charset=utf-8","Cache-Control":"no-store"} · body: "You are still signed in."
Send a POST without the session cookie again as a GET resent.as_get	303 · headers: {"Location":"<issuer>/oauth/end-session?<the validated parameters, as the POST carried them>","Cache-Control":"no-store"}
Refuse a client_id that is not the hint's audience invalid_request.client_mismatch	400 · headers: {"Content-Type":"text/html; charset=utf-8","Cache-Control":"no-store"} · body: the info page: "This sign-out request is not valid. You are still signed in; nothing was changed.", with the request id
Refuse a return URI when no client is named invalid_request.return_without_client	400 · headers: {"Content-Type":"text/html; charset=utf-8","Cache-Control":"no-store"} · body: the info page: "This sign-out request is not valid. You are still signed in; nothing was changed.", with the request id
Refuse a return URI the client did not register invalid_request.return_not_registered	400 · headers: {"Content-Type":"text/html; charset=utf-8","Cache-Control":"no-store"} · body: the info page: "This sign-out request is not valid. You are still signed in; nothing was changed.", with the request id
Refuse a return URI of a disabled or suspended client invalid_request.return_client_unusable	400 · headers: {"Content-Type":"text/html; charset=utf-8","Cache-Control":"no-store"} · body: the info page: "This sign-out request is not valid. You are still signed in; nothing was changed.", with the request id
Refuse a host QAuth does not answer for misdirected_request.host	421 · body: {"type":"https://docs.qauth.dev/reference/problem-types/#misdirected-request","status":421,"code":"misdirected_request","trace_id":"the request id"}
Refuse a request over the end-session limit too_many_requests.end_session_limit	429 · headers: {"retry-after":"the seconds until the window resets"} · body: {"type":"https://docs.qauth.dev/reference/problem-types/#too-many-requests","status":429,"code":"too_many_requests","trace_id":"the request id"}
Refuse parameters the schema does not accept validation_error.params	400 · body: {"type":"https://docs.qauth.dev/reference/problem-types/#validation-error","status":400,"code":"validation_error","trace_id":"the request id"}
Refuse an answer the step grammar does not accept invalid_answer.grammar	400 · headers: {"Content-Type":"application/problem+json","Cache-Control":"no-store"} · body: {"type":"https://docs.qauth.dev/reference/problem-types/#invalid-answer","status":400,"code":"invalid_answer","trace_id":"the request id"}
Refuse an answer the expiry sweep beat interaction_expired.finished_late	410 · headers: {"Content-Type":"application/problem+json","Cache-Control":"no-store"} · body: {"type":"https://docs.qauth.dev/reference/problem-types/#interaction-expired","status":410,"code":"interaction_expired","trace_id":"the request id"}
Refuse a cancel the expiry sweep beat interaction_expired.cancelled_late	410 · headers: {"Content-Type":"application/problem+json","Cache-Control":"no-store"} · body: {"type":"https://docs.qauth.dev/reference/problem-types/#interaction-expired","status":410,"code":"interaction_expired","trace_id":"the request id"}
Fail on an event store error server_error.event_store	500 · body: {"type":"https://docs.qauth.dev/reference/problem-types/#internal-error","status":500,"code":"internal_error","trace_id":"the request id"}
Fail on a session store error server_error.session_store	500 · body: {"type":"https://docs.qauth.dev/reference/problem-types/#internal-error","status":500,"code":"internal_error","trace_id":"the request id"}
Fail on an interaction store error at the start server_error.interaction_store	500 · body: {"type":"https://docs.qauth.dev/reference/problem-types/#internal-error","status":500,"code":"internal_error","trace_id":"the request id"}
Fail on an interaction store error at the answer or the cancel server_error.interaction_store_at_finish	500 · body: {"type":"https://docs.qauth.dev/reference/problem-types/#internal-error","status":500,"code":"internal_error","trace_id":"the request id"}
Fail on a session store error after the interaction finished server_error.session_store_at_finish	500 · body: {"type":"https://docs.qauth.dev/reference/problem-types/#internal-error","status":500,"code":"internal_error","trace_id":"the request id"}
Fail on an event store error after the interaction finished server_error.event_store_at_finish	500 · body: {"type":"https://docs.qauth.dev/reference/problem-types/#internal-error","status":500,"code":"internal_error","trace_id":"the request id"}

How it decides what happens next

Find the realm of the host

#	If	Then
1	the host names no enabled realm with an issuer	Refuse a host QAuth does not answer for
2	the request has its realm	Count the request against the end-session limit

The first matching rule wins.

Exact conditions

#	Condition	Goes to	Situations
1	`host == 'unknown'`	`misdirected_request.host`	55296 of 110592
2	otherwise	`rateLimiting`	55296 of 110592

Count the request against the end-session limit

#	If	Then
1	the address has used up its end-session requests	Refuse a request over the end-session limit
2	the address is under its limit	Check the parameters against the schema

The first matching rule wins.

Exact conditions

#	Condition	Goes to	Situations
1	`overLimit`	`too_many_requests.end_session_limit`	27648 of 55296
2	otherwise	`validatingParams`	27648 of 55296

Check the parameters against the schema

#	If	Then
1	a parameter is repeated or over its bound	Refuse parameters the schema does not accept
2	a POST came without the session cookie: it is sent again as a GET, which carries the cookie	Send a POST without the session cookie again as a GET
3	the parameters pass the schema	Verify the id_token_hint, and accept it expired

The first matching rule wins.

Exact conditions

#	Condition	Goes to	Situations
1	`params == 'malformed'`	`validation_error.params`	13824 of 27648
2	`method == 'postWithoutCookie'`	`resent.as_get`	4608 of 27648
3	otherwise	`verifyingHint`	9216 of 27648

Verify the id_token_hint, and accept it expired

#	If	Then
1	the hint is read, or counted as absent	Check client_id against the hint

The first matching rule wins.

Exact conditions

#	Condition	Goes to	Situations
1	otherwise	`checkingClient`	9216 of 9216

Check client_id against the hint

#	If	Then
1	client_id is not the hint's audience; user.sign_out_failed (client_id_mismatch) is recorded	Refuse a client_id that is not the hint's audience
2	client_id is absent or matches	Check the return URI against the client's registration

The first matching rule wins.

Exact conditions

#	Condition	Goes to	Situations
1	`clientGate == 'mismatch' and hintValid`	`invalid_request.client_mismatch`	2304 of 9216
2	otherwise	`checkingReturn`	6912 of 9216

hintValid: hint in ['valid', 'expired']

Check the return URI against the client's registration

#	If	Then
1	no client is named; user.sign_out_failed (post_logout_redirect_uri_without_client) is recorded	Refuse a return URI when no client is named
2	the client does not register the URI; user.sign_out_failed (post_logout_redirect_uri_not_registered)	Refuse a return URI the client did not register
3	the client is disabled or suspended; user.sign_out_failed (client_unusable) is recorded	Refuse a return URI of a disabled or suspended client
4	there is no return URI, or it is registered	Find the browser's session

The first matching rule wins.

Exact conditions

#	Condition	Goes to	Situations
1	`returnTo == 'noClient'`	`invalid_request.return_without_client`	1152 of 6912
2	`returnTo == 'unregistered'`	`invalid_request.return_not_registered`	1152 of 6912
3	`returnTo == 'clientUnusable'`	`invalid_request.return_client_unusable`	1152 of 6912
4	otherwise	`findingSession`	3456 of 6912

Find the browser's session

#	If	Then
1	the browser holds no live session: nothing to end	Record that there was nothing to end
2	the valid hint names the session's account: no confirmation is asked	End the browser's session
3	no valid hint names the account of the session: the person is asked	Start the logout_confirm interaction

The first matching rule wins.

Exact conditions

#	Condition	Goes to	Situations
1	`account == 'none'`	`recordingNoSession`	1152 of 3456
2	`account == 'hinted' and hintValid`	`endingSession`	384 of 3456
3	otherwise	`startingConfirm`	1920 of 3456

hintValid: hint in ['valid', 'expired']

Check the answer against the step's grammar

#	If	Then
1	the answer does not pass the step grammar	Refuse an answer the step grammar does not accept
2	the answer passes the grammar	End the interaction before anything is decided

The first matching rule wins.

Exact conditions

#	Condition	Goes to	Situations
1	`decision == 'malformed'`	`invalid_answer.grammar`	480 of 1920
2	otherwise	`takingFinish`	1440 of 1920

Read the decision

#	If	Then
1	the person stays signed in	Record that the person stayed signed in
2	the person signs out, and the session has already ended	Record that there was nothing left to end
3	the person signs out (logout, or logout_all, which ends the same one session today)	End the session the step was started for

The first matching rule wins.

Exact conditions

#	Condition	Goes to	Situations
1	`declined`	`recordingDecline`	480 of 1440
2	`sessionAtFinish == 'ended'`	`recordingNoSessionAtFinish`	480 of 1440
3	otherwise	`endingConfirmedSession`	480 of 1440

declined: decision == 'stay'

Read whether the browser is still signed in

#	If	Then
1	the browser holds no live session	Say that the browser is signed out
2	the browser holds a live session	Say that the browser is still signed in

The first matching rule wins.

Exact conditions

#	Condition	Goes to	Situations
1	`account == 'none'`	`status.signed_out`	36864 of 110592
2	otherwise	`status.signed_in`	73728 of 110592

Every way it can end

It ends with	When	What happens
Send the browser back to the app, signed out redirect with state	The host is a host of an enabled realm that has an issuer, the address is under its end-session limit, the request is a GET, every parameter is given at most once and within its bound; the POST body is a form, an ID token this realm issued: its signature verifies with a key of the realm's token keys (EdDSA or RS256), its iss is the realm's issuer, its typ is an ID token's, and it has not expired, client_id is absent, or it is the valid hint's aud, post_logout_redirect_uri is, exactly, one of the post_logout_redirect_uris of the client the valid hint's aud or client_id names, that client may be used, and the operator set it up (the seed manifest), the browser's session is of the account the valid hint's sub names, the hint's sid is that session's, and the client the hint was issued to is known and may be used, INTERACTION_UI_ENABLED is off (the default): the end-session route draws the step as a plain form, the person signs out of the account the request is for, when the step is answered, the client still registers the return URI and may be used, the session the step was started for is still live when the step is answered	Wait for an end-session request: GET /oauth/end-session with a query, or POST /oauth/end-session with a form, arrives Find the realm of the host: the request has its realm Count the request against the end-session limit: the address is under its limit Check the parameters against the schema: the parameters pass the schema Verify the id_token_hint, and accept it expired: the hint is read, or counted as absent Check client_id against the hint: client_id is absent or matches Check the return URI against the client's registration: there is no return URI, or it is registered Find the browser's session: the valid hint names the session's account: no confirmation is asked End the browser's session: the session is ended Record the sign-out: the request carries a registered return URI of a client the operator set up
Send the browser back to the app; it was not signed in redirect with state	The host is a host of an enabled realm that has an issuer, the address is under its end-session limit, the request is a GET, every parameter is given at most once and within its bound; the POST body is a form, the request carries no id_token_hint, client_id is absent, or it is the valid hint's aud, post_logout_redirect_uri is, exactly, one of the post_logout_redirect_uris of the client the valid hint's aud or client_id names, that client may be used, and the operator set it up (the seed manifest), the browser holds no live session of this realm, INTERACTION_UI_ENABLED is off (the default): the end-session route draws the step as a plain form, the person signs out of the account the request is for, when the step is answered, the client still registers the return URI and may be used, the session the step was started for is still live when the step is answered	Wait for an end-session request: GET /oauth/end-session with a query, or POST /oauth/end-session with a form, arrives Find the realm of the host: the request has its realm Count the request against the end-session limit: the address is under its limit Check the parameters against the schema: the parameters pass the schema Verify the id_token_hint, and accept it expired: the hint is read, or counted as absent Check client_id against the hint: client_id is absent or matches Check the return URI against the client's registration: there is no return URI, or it is registered Find the browser's session: the browser holds no live session: nothing to end Record that there was nothing to end: the request carries a registered return URI of a client the operator set up
Show that the browser is signed out no redirect, page shown	The host is a host of an enabled realm that has an issuer, the address is under its end-session limit, the request is a GET, every parameter is given at most once and within its bound; the POST body is a form, an ID token this realm issued: its signature verifies with a key of the realm's token keys (EdDSA or RS256), its iss is the realm's issuer, its typ is an ID token's, and it has not expired, client_id is absent, or it is the valid hint's aud, the request carries no post_logout_redirect_uri, the browser's session is of the account the valid hint's sub names, the hint's sid is that session's, and the client the hint was issued to is known and may be used, INTERACTION_UI_ENABLED is off (the default): the end-session route draws the step as a plain form, the person signs out of the account the request is for, when the step is answered, the client still registers the return URI and may be used, the session the step was started for is still live when the step is answered	Wait for an end-session request: GET /oauth/end-session with a query, or POST /oauth/end-session with a form, arrives Find the realm of the host: the request has its realm Count the request against the end-session limit: the address is under its limit Check the parameters against the schema: the parameters pass the schema Verify the id_token_hint, and accept it expired: the hint is read, or counted as absent Check client_id against the hint: client_id is absent or matches Check the return URI against the client's registration: there is no return URI, or it is registered Find the browser's session: the valid hint names the session's account: no confirmation is asked End the browser's session: the session is ended Record the sign-out: there is nowhere to return
Show that the browser is signed out; it was not signed in no redirect, page shown	The host is a host of an enabled realm that has an issuer, the address is under its end-session limit, the request is a GET, every parameter is given at most once and within its bound; the POST body is a form, the request carries no id_token_hint, client_id is absent, or it is the valid hint's aud, the request carries no post_logout_redirect_uri, the browser holds no live session of this realm, INTERACTION_UI_ENABLED is off (the default): the end-session route draws the step as a plain form, the person signs out of the account the request is for, when the step is answered, the client still registers the return URI and may be used, the session the step was started for is still live when the step is answered	Wait for an end-session request: GET /oauth/end-session with a query, or POST /oauth/end-session with a form, arrives Find the realm of the host: the request has its realm Count the request against the end-session limit: the address is under its limit Check the parameters against the schema: the parameters pass the schema Verify the id_token_hint, and accept it expired: the hint is read, or counted as absent Check client_id against the hint: client_id is absent or matches Check the return URI against the client's registration: there is no return URI, or it is registered Find the browser's session: the browser holds no live session: nothing to end Record that there was nothing to end: there is nowhere to return
Show that the browser is signed out, with a link back to an app the operator did not set up no redirect, page shown	The host is a host of an enabled realm that has an issuer, the address is under its end-session limit, the request is a GET, every parameter is given at most once and within its bound; the POST body is a form, an ID token this realm issued: its signature verifies with a key of the realm's token keys (EdDSA or RS256), its iss is the realm's issuer, its typ is an ID token's, and it has not expired, client_id is absent, or it is the valid hint's aud, as registered, but the client was not set up by the operator (open dynamic registration, a CIMD document, the developer API): whoever registered it chose the URI, so the browser is not sent there before it has seen a QAuth page (RFC 9700 §4.11.2), the browser's session is of the account the valid hint's sub names, the hint's sid is that session's, and the client the hint was issued to is known and may be used, INTERACTION_UI_ENABLED is off (the default): the end-session route draws the step as a plain form, the person signs out of the account the request is for, when the step is answered, the client still registers the return URI and may be used, the session the step was started for is still live when the step is answered	Wait for an end-session request: GET /oauth/end-session with a query, or POST /oauth/end-session with a form, arrives Find the realm of the host: the request has its realm Count the request against the end-session limit: the address is under its limit Check the parameters against the schema: the parameters pass the schema Verify the id_token_hint, and accept it expired: the hint is read, or counted as absent Check client_id against the hint: client_id is absent or matches Check the return URI against the client's registration: there is no return URI, or it is registered Find the browser's session: the valid hint names the session's account: no confirmation is asked End the browser's session: the session is ended Record the sign-out: the request carries a registered return URI of a client the operator did not set up
Show that the browser is signed out, with a link back to an app the operator did not set up; it was not signed in no redirect, page shown	The host is a host of an enabled realm that has an issuer, the address is under its end-session limit, the request is a GET, every parameter is given at most once and within its bound; the POST body is a form, the request carries no id_token_hint, client_id is absent, or it is the valid hint's aud, as registered, but the client was not set up by the operator (open dynamic registration, a CIMD document, the developer API): whoever registered it chose the URI, so the browser is not sent there before it has seen a QAuth page (RFC 9700 §4.11.2), the browser holds no live session of this realm, INTERACTION_UI_ENABLED is off (the default): the end-session route draws the step as a plain form, the person signs out of the account the request is for, when the step is answered, the client still registers the return URI and may be used, the session the step was started for is still live when the step is answered	Wait for an end-session request: GET /oauth/end-session with a query, or POST /oauth/end-session with a form, arrives Find the realm of the host: the request has its realm Count the request against the end-session limit: the address is under its limit Check the parameters against the schema: the parameters pass the schema Verify the id_token_hint, and accept it expired: the hint is read, or counted as absent Check client_id against the hint: client_id is absent or matches Check the return URI against the client's registration: there is no return URI, or it is registered Find the browser's session: the browser holds no live session: nothing to end Record that there was nothing to end: the request carries a registered return URI of a client the operator did not set up
Send the browser back to the app after the person signed out redirect with state	The host is a host of an enabled realm that has an issuer, the address is under its end-session limit, the request is a GET, every parameter is given at most once and within its bound; the POST body is a form, the request carries no id_token_hint, client_id is absent, or it is the valid hint's aud, post_logout_redirect_uri is, exactly, one of the post_logout_redirect_uris of the client the valid hint's aud or client_id names, that client may be used, and the operator set it up (the seed manifest), the browser's session is of the account the valid hint's sub names, the hint's sid is that session's, and the client the hint was issued to is known and may be used, INTERACTION_UI_ENABLED is off (the default): the end-session route draws the step as a plain form, the person signs out of the account the request is for, when the step is answered, the client still registers the return URI and may be used, the session the step was started for is still live when the step is answered	Wait for an end-session request: GET /oauth/end-session with a query, or POST /oauth/end-session with a form, arrives Find the realm of the host: the request has its realm Count the request against the end-session limit: the address is under its limit Check the parameters against the schema: the parameters pass the schema Verify the id_token_hint, and accept it expired: the hint is read, or counted as absent Check client_id against the hint: client_id is absent or matches Check the return URI against the client's registration: there is no return URI, or it is registered Find the browser's session: no valid hint names the account of the session: the person is asked Start the logout_confirm interaction: the interaction is stored, and the route draws the step itself Show the confirm step as a plain form: the person presses a button: the form posts the answer Check the answer against the step's grammar: the answer passes the grammar End the interaction before anything is decided: the interaction is over Read the decision: the person signs out (logout, or logout_all, which ends the same one session today) End the session the step was started for: the session is ended Record the sign-out: the client still registers the return URI
Send the browser to the status page after the person signed out no redirect, page shown	The host is a host of an enabled realm that has an issuer, the address is under its end-session limit, the request is a GET, every parameter is given at most once and within its bound; the POST body is a form, the request carries no id_token_hint, client_id is absent, or it is the valid hint's aud, the request carries no post_logout_redirect_uri, the browser's session is of the account the valid hint's sub names, the hint's sid is that session's, and the client the hint was issued to is known and may be used, INTERACTION_UI_ENABLED is off (the default): the end-session route draws the step as a plain form, the person signs out of the account the request is for, when the step is answered, the client still registers the return URI and may be used, the session the step was started for is still live when the step is answered	Wait for an end-session request: GET /oauth/end-session with a query, or POST /oauth/end-session with a form, arrives Find the realm of the host: the request has its realm Count the request against the end-session limit: the address is under its limit Check the parameters against the schema: the parameters pass the schema Verify the id_token_hint, and accept it expired: the hint is read, or counted as absent Check client_id against the hint: client_id is absent or matches Check the return URI against the client's registration: there is no return URI, or it is registered Find the browser's session: no valid hint names the account of the session: the person is asked Start the logout_confirm interaction: the interaction is stored, and the route draws the step itself Show the confirm step as a plain form: the person presses a button: the form posts the answer Check the answer against the step's grammar: the answer passes the grammar End the interaction before anything is decided: the interaction is over Read the decision: the person signs out (logout, or logout_all, which ends the same one session today) End the session the step was started for: the session is ended Record the sign-out: there is nowhere to return, or no longer
Send the browser back to the app; its session had already ended redirect with state	The host is a host of an enabled realm that has an issuer, the address is under its end-session limit, the request is a GET, every parameter is given at most once and within its bound; the POST body is a form, the request carries no id_token_hint, client_id is absent, or it is the valid hint's aud, post_logout_redirect_uri is, exactly, one of the post_logout_redirect_uris of the client the valid hint's aud or client_id names, that client may be used, and the operator set it up (the seed manifest), the browser's session is of the account the valid hint's sub names, the hint's sid is that session's, and the client the hint was issued to is known and may be used, INTERACTION_UI_ENABLED is off (the default): the end-session route draws the step as a plain form, the person signs out of the account the request is for, when the step is answered, the client still registers the return URI and may be used, it ended meanwhile: a sign-out in another tab, a revoke, or its own end	Wait for an end-session request: GET /oauth/end-session with a query, or POST /oauth/end-session with a form, arrives Find the realm of the host: the request has its realm Count the request against the end-session limit: the address is under its limit Check the parameters against the schema: the parameters pass the schema Verify the id_token_hint, and accept it expired: the hint is read, or counted as absent Check client_id against the hint: client_id is absent or matches Check the return URI against the client's registration: there is no return URI, or it is registered Find the browser's session: no valid hint names the account of the session: the person is asked Start the logout_confirm interaction: the interaction is stored, and the route draws the step itself Show the confirm step as a plain form: the person presses a button: the form posts the answer Check the answer against the step's grammar: the answer passes the grammar End the interaction before anything is decided: the interaction is over Read the decision: the person signs out, and the session has already ended Record that there was nothing left to end: the client still registers the return URI
Send the browser to the status page; its session had already ended no redirect, page shown	The host is a host of an enabled realm that has an issuer, the address is under its end-session limit, the request is a GET, every parameter is given at most once and within its bound; the POST body is a form, the request carries no id_token_hint, client_id is absent, or it is the valid hint's aud, the request carries no post_logout_redirect_uri, the browser's session is of the account the valid hint's sub names, the hint's sid is that session's, and the client the hint was issued to is known and may be used, INTERACTION_UI_ENABLED is off (the default): the end-session route draws the step as a plain form, the person signs out of the account the request is for, when the step is answered, the client still registers the return URI and may be used, it ended meanwhile: a sign-out in another tab, a revoke, or its own end	Wait for an end-session request: GET /oauth/end-session with a query, or POST /oauth/end-session with a form, arrives Find the realm of the host: the request has its realm Count the request against the end-session limit: the address is under its limit Check the parameters against the schema: the parameters pass the schema Verify the id_token_hint, and accept it expired: the hint is read, or counted as absent Check client_id against the hint: client_id is absent or matches Check the return URI against the client's registration: there is no return URI, or it is registered Find the browser's session: no valid hint names the account of the session: the person is asked Start the logout_confirm interaction: the interaction is stored, and the route draws the step itself Show the confirm step as a plain form: the person presses a button: the form posts the answer Check the answer against the step's grammar: the answer passes the grammar End the interaction before anything is decided: the interaction is over Read the decision: the person signs out, and the session has already ended Record that there was nothing left to end: there is nowhere to return, or no longer
Send the browser back to the app, still signed in to QAuth redirect with state	The host is a host of an enabled realm that has an issuer, the address is under its end-session limit, the request is a GET, every parameter is given at most once and within its bound; the POST body is a form, the request carries no id_token_hint, client_id is absent, or it is the valid hint's aud, post_logout_redirect_uri is, exactly, one of the post_logout_redirect_uris of the client the valid hint's aud or client_id names, that client may be used, and the operator set it up (the seed manifest), the browser's session is of the account the valid hint's sub names, the hint's sid is that session's, and the client the hint was issued to is known and may be used, INTERACTION_UI_ENABLED is on: the ceremony app draws the step, the person signs out of the account the request is for, when the step is answered, the client still registers the return URI and may be used, the session the step was started for is still live when the step is answered	Wait for an end-session request: GET /oauth/end-session with a query, or POST /oauth/end-session with a form, arrives Find the realm of the host: the request has its realm Count the request against the end-session limit: the address is under its limit Check the parameters against the schema: the parameters pass the schema Verify the id_token_hint, and accept it expired: the hint is read, or counted as absent Check client_id against the hint: client_id is absent or matches Check the return URI against the client's registration: there is no return URI, or it is registered Find the browser's session: no valid hint names the account of the session: the person is asked Start the logout_confirm interaction: the interaction is stored, and the ceremony app draws the step Send the browser to the ceremony page of the confirm step: the ceremony page reads the step by the interaction id Return the confirm step: the person cancels, with the CSRF value of this view Cancel the interaction: the interaction is cancelled Record that the person stayed signed in: the client still registers the return URI: the app has signed the person out of itself
Send the browser to the status page, still signed in no redirect, page shown	The host is a host of an enabled realm that has an issuer, the address is under its end-session limit, the request is a GET, every parameter is given at most once and within its bound; the POST body is a form, the request carries no id_token_hint, client_id is absent, or it is the valid hint's aud, the request carries no post_logout_redirect_uri, the browser's session is of the account the valid hint's sub names, the hint's sid is that session's, and the client the hint was issued to is known and may be used, INTERACTION_UI_ENABLED is on: the ceremony app draws the step, the person signs out of the account the request is for, when the step is answered, the client still registers the return URI and may be used, the session the step was started for is still live when the step is answered	Wait for an end-session request: GET /oauth/end-session with a query, or POST /oauth/end-session with a form, arrives Find the realm of the host: the request has its realm Count the request against the end-session limit: the address is under its limit Check the parameters against the schema: the parameters pass the schema Verify the id_token_hint, and accept it expired: the hint is read, or counted as absent Check client_id against the hint: client_id is absent or matches Check the return URI against the client's registration: there is no return URI, or it is registered Find the browser's session: no valid hint names the account of the session: the person is asked Start the logout_confirm interaction: the interaction is stored, and the ceremony app draws the step Send the browser to the ceremony page of the confirm step: the ceremony page reads the step by the interaction id Return the confirm step: the person cancels, with the CSRF value of this view Cancel the interaction: the interaction is cancelled Record that the person stayed signed in: there is nowhere to return, or no longer
Say that the browser is signed out no redirect, page shown	The host is a host of an enabled realm that has an issuer, the address is under its end-session limit, the request is a GET, every parameter is given at most once and within its bound; the POST body is a form, the request carries no id_token_hint, client_id is absent, or it is the valid hint's aud, the request carries no post_logout_redirect_uri, the browser holds no live session of this realm, INTERACTION_UI_ENABLED is off (the default): the end-session route draws the step as a plain form, the person signs out of the account the request is for, when the step is answered, the client still registers the return URI and may be used, the session the step was started for is still live when the step is answered	Wait for an end-session request: GET /oauth/end-session/status arrives Read whether the browser is still signed in: the browser holds no live session
Say that the browser is still signed in no redirect, page shown	The host is a host of an enabled realm that has an issuer, the address is under its end-session limit, the request is a GET, every parameter is given at most once and within its bound; the POST body is a form, the request carries no id_token_hint, client_id is absent, or it is the valid hint's aud, the request carries no post_logout_redirect_uri, the browser's session is of the account the valid hint's sub names, the hint's sid is that session's, and the client the hint was issued to is known and may be used, INTERACTION_UI_ENABLED is off (the default): the end-session route draws the step as a plain form, the person signs out of the account the request is for, when the step is answered, the client still registers the return URI and may be used, the session the step was started for is still live when the step is answered	Wait for an end-session request: GET /oauth/end-session/status arrives Read whether the browser is still signed in: the browser holds a live session
Send a POST without the session cookie again as a GET no redirect, page shown	The host is a host of an enabled realm that has an issuer, the address is under its end-session limit, the request is a POST without the session cookie: the browser withholds a SameSite=Lax cookie from a cross-site POST, so it cannot tell whether it is signed in, every parameter is given at most once and within its bound; the POST body is a form, the request carries no id_token_hint, client_id is absent, or it is the valid hint's aud, the request carries no post_logout_redirect_uri, the browser holds no live session of this realm, INTERACTION_UI_ENABLED is off (the default): the end-session route draws the step as a plain form, the person signs out of the account the request is for, when the step is answered, the client still registers the return URI and may be used, the session the step was started for is still live when the step is answered	Wait for an end-session request: GET /oauth/end-session with a query, or POST /oauth/end-session with a form, arrives Find the realm of the host: the request has its realm Count the request against the end-session limit: the address is under its limit Check the parameters against the schema: a POST came without the session cookie: it is sent again as a GET, which carries the cookie
Refuse a client_id that is not the hint's audience no redirect, page shown	The host is a host of an enabled realm that has an issuer, the address is under its end-session limit, the request is a GET, every parameter is given at most once and within its bound; the POST body is a form, an ID token this realm issued: its signature verifies with a key of the realm's token keys (EdDSA or RS256), its iss is the realm's issuer, its typ is an ID token's, and it has not expired, client_id and the aud of a valid hint name different clients (§2: the OP MUST verify they match), the request carries no post_logout_redirect_uri, the browser holds no live session of this realm, INTERACTION_UI_ENABLED is off (the default): the end-session route draws the step as a plain form, the person signs out of the account the request is for, when the step is answered, the client still registers the return URI and may be used, the session the step was started for is still live when the step is answered	Wait for an end-session request: GET /oauth/end-session with a query, or POST /oauth/end-session with a form, arrives Find the realm of the host: the request has its realm Count the request against the end-session limit: the address is under its limit Check the parameters against the schema: the parameters pass the schema Verify the id_token_hint, and accept it expired: the hint is read, or counted as absent Check client_id against the hint: client_id is not the hint's audience; user.sign_out_failed (client_id_mismatch) is recorded
Refuse a return URI when no client is named no redirect, page shown	The host is a host of an enabled realm that has an issuer, the address is under its end-session limit, the request is a GET, every parameter is given at most once and within its bound; the POST body is a form, the request carries no id_token_hint, client_id is absent, or it is the valid hint's aud, post_logout_redirect_uri is given, and neither client_id nor a valid hint names a client, the browser holds no live session of this realm, INTERACTION_UI_ENABLED is off (the default): the end-session route draws the step as a plain form, the person signs out of the account the request is for, when the step is answered, the client still registers the return URI and may be used, the session the step was started for is still live when the step is answered	Wait for an end-session request: GET /oauth/end-session with a query, or POST /oauth/end-session with a form, arrives Find the realm of the host: the request has its realm Count the request against the end-session limit: the address is under its limit Check the parameters against the schema: the parameters pass the schema Verify the id_token_hint, and accept it expired: the hint is read, or counted as absent Check client_id against the hint: client_id is absent or matches Check the return URI against the client's registration: no client is named; user.sign_out_failed (post_logout_redirect_uri_without_client) is recorded
Refuse a return URI the client did not register no redirect, page shown	The host is a host of an enabled realm that has an issuer, the address is under its end-session limit, the request is a GET, every parameter is given at most once and within its bound; the POST body is a form, the request carries no id_token_hint, client_id is absent, or it is the valid hint's aud, post_logout_redirect_uri is given, and the client named is unknown or does not register exactly that URI (a client that registered none never gets a redirect), the browser holds no live session of this realm, INTERACTION_UI_ENABLED is off (the default): the end-session route draws the step as a plain form, the person signs out of the account the request is for, when the step is answered, the client still registers the return URI and may be used, the session the step was started for is still live when the step is answered	Wait for an end-session request: GET /oauth/end-session with a query, or POST /oauth/end-session with a form, arrives Find the realm of the host: the request has its realm Count the request against the end-session limit: the address is under its limit Check the parameters against the schema: the parameters pass the schema Verify the id_token_hint, and accept it expired: the hint is read, or counted as absent Check client_id against the hint: client_id is absent or matches Check the return URI against the client's registration: the client does not register the URI; user.sign_out_failed (post_logout_redirect_uri_not_registered)
Refuse a return URI of a disabled or suspended client no redirect, page shown	The host is a host of an enabled realm that has an issuer, the address is under its end-session limit, the request is a GET, every parameter is given at most once and within its bound; the POST body is a form, the request carries no id_token_hint, client_id is absent, or it is the valid hint's aud, post_logout_redirect_uri is given, and the client named is disabled or suspended, the browser holds no live session of this realm, INTERACTION_UI_ENABLED is off (the default): the end-session route draws the step as a plain form, the person signs out of the account the request is for, when the step is answered, the client still registers the return URI and may be used, the session the step was started for is still live when the step is answered	Wait for an end-session request: GET /oauth/end-session with a query, or POST /oauth/end-session with a form, arrives Find the realm of the host: the request has its realm Count the request against the end-session limit: the address is under its limit Check the parameters against the schema: the parameters pass the schema Verify the id_token_hint, and accept it expired: the hint is read, or counted as absent Check client_id against the hint: client_id is absent or matches Check the return URI against the client's registration: the client is disabled or suspended; user.sign_out_failed (client_unusable) is recorded
Refuse a host QAuth does not answer for no redirect, page shown	The host names no realm, a disabled realm or a realm with no issuer, the address is under its end-session limit, the request is a GET, every parameter is given at most once and within its bound; the POST body is a form, the request carries no id_token_hint, client_id is absent, or it is the valid hint's aud, the request carries no post_logout_redirect_uri, the browser holds no live session of this realm, INTERACTION_UI_ENABLED is off (the default): the end-session route draws the step as a plain form, the person signs out of the account the request is for, when the step is answered, the client still registers the return URI and may be used, the session the step was started for is still live when the step is answered	Wait for an end-session request: GET /oauth/end-session with a query, or POST /oauth/end-session with a form, arrives Find the realm of the host: the host names no enabled realm with an issuer
Refuse a request over the end-session limit no redirect, page shown	The host is a host of an enabled realm that has an issuer, this client address has used up its end-session requests for the window, the request is a GET, every parameter is given at most once and within its bound; the POST body is a form, the request carries no id_token_hint, client_id is absent, or it is the valid hint's aud, the request carries no post_logout_redirect_uri, the browser holds no live session of this realm, INTERACTION_UI_ENABLED is off (the default): the end-session route draws the step as a plain form, the person signs out of the account the request is for, when the step is answered, the client still registers the return URI and may be used, the session the step was started for is still live when the step is answered	Wait for an end-session request: GET /oauth/end-session with a query, or POST /oauth/end-session with a form, arrives Find the realm of the host: the request has its realm Count the request against the end-session limit: the address has used up its end-session requests
Refuse parameters the schema does not accept no redirect, page shown	The host is a host of an enabled realm that has an issuer, the address is under its end-session limit, the request is a GET, a parameter is repeated or over its bound, or the POST body is not a form, the request carries no id_token_hint, client_id is absent, or it is the valid hint's aud, the request carries no post_logout_redirect_uri, the browser holds no live session of this realm, INTERACTION_UI_ENABLED is off (the default): the end-session route draws the step as a plain form, the person signs out of the account the request is for, when the step is answered, the client still registers the return URI and may be used, the session the step was started for is still live when the step is answered	Wait for an end-session request: GET /oauth/end-session with a query, or POST /oauth/end-session with a form, arrives Find the realm of the host: the request has its realm Count the request against the end-session limit: the address is under its limit Check the parameters against the schema: a parameter is repeated or over its bound
Refuse an answer the step grammar does not accept no redirect, page shown	The host is a host of an enabled realm that has an issuer, the address is under its end-session limit, the request is a GET, every parameter is given at most once and within its bound; the POST body is a form, the request carries no id_token_hint, client_id is absent, or it is the valid hint's aud, the request carries no post_logout_redirect_uri, the browser's session is of the account the valid hint's sub names, the hint's sid is that session's, and the client the hint was issued to is known and may be used, INTERACTION_UI_ENABLED is off (the default): the end-session route draws the step as a plain form, the answer does not pass the step grammar: no decision, another one, or a member beyond type, csrf and decision, when the step is answered, the client still registers the return URI and may be used, the session the step was started for is still live when the step is answered	Wait for an end-session request: GET /oauth/end-session with a query, or POST /oauth/end-session with a form, arrives Find the realm of the host: the request has its realm Count the request against the end-session limit: the address is under its limit Check the parameters against the schema: the parameters pass the schema Verify the id_token_hint, and accept it expired: the hint is read, or counted as absent Check client_id against the hint: client_id is absent or matches Check the return URI against the client's registration: there is no return URI, or it is registered Find the browser's session: no valid hint names the account of the session: the person is asked Start the logout_confirm interaction: the interaction is stored, and the route draws the step itself Show the confirm step as a plain form: the person presses a button: the form posts the answer Check the answer against the step's grammar: the answer does not pass the step grammar
Refuse an answer the expiry sweep beat no redirect, page shown	The host is a host of an enabled realm that has an issuer, the address is under its end-session limit, the request is a GET, every parameter is given at most once and within its bound; the POST body is a form, the request carries no id_token_hint, client_id is absent, or it is the valid hint's aud, the request carries no post_logout_redirect_uri, the browser's session is of the account the valid hint's sub names, the hint's sid is that session's, and the client the hint was issued to is known and may be used, INTERACTION_UI_ENABLED is off (the default): the end-session route draws the step as a plain form, the person signs out of the account the request is for, when the step is answered, the client still registers the return URI and may be used, the session the step was started for is still live when the step is answered	Wait for an end-session request: GET /oauth/end-session with a query, or POST /oauth/end-session with a form, arrives Find the realm of the host: the request has its realm Count the request against the end-session limit: the address is under its limit Check the parameters against the schema: the parameters pass the schema Verify the id_token_hint, and accept it expired: the hint is read, or counted as absent Check client_id against the hint: client_id is absent or matches Check the return URI against the client's registration: there is no return URI, or it is registered Find the browser's session: no valid hint names the account of the session: the person is asked Start the logout_confirm interaction: the interaction is stored, and the route draws the step itself Show the confirm step as a plain form: the person presses a button: the form posts the answer Check the answer against the step's grammar: the answer passes the grammar End the interaction before anything is decided: it fails, because the expiry sweep claimed the interaction first
Refuse a cancel the expiry sweep beat no redirect, page shown	The host is a host of an enabled realm that has an issuer, the address is under its end-session limit, the request is a GET, every parameter is given at most once and within its bound; the POST body is a form, the request carries no id_token_hint, client_id is absent, or it is the valid hint's aud, the request carries no post_logout_redirect_uri, the browser's session is of the account the valid hint's sub names, the hint's sid is that session's, and the client the hint was issued to is known and may be used, INTERACTION_UI_ENABLED is on: the ceremony app draws the step, the person signs out of the account the request is for, when the step is answered, the client still registers the return URI and may be used, the session the step was started for is still live when the step is answered	Wait for an end-session request: GET /oauth/end-session with a query, or POST /oauth/end-session with a form, arrives Find the realm of the host: the request has its realm Count the request against the end-session limit: the address is under its limit Check the parameters against the schema: the parameters pass the schema Verify the id_token_hint, and accept it expired: the hint is read, or counted as absent Check client_id against the hint: client_id is absent or matches Check the return URI against the client's registration: there is no return URI, or it is registered Find the browser's session: no valid hint names the account of the session: the person is asked Start the logout_confirm interaction: the interaction is stored, and the ceremony app draws the step Send the browser to the ceremony page of the confirm step: the ceremony page reads the step by the interaction id Return the confirm step: the person cancels, with the CSRF value of this view Cancel the interaction: it fails, because the expiry sweep claimed the interaction first
Fail on an event store error no redirect, page shown	The host is a host of an enabled realm that has an issuer, the address is under its end-session limit, the request is a GET, every parameter is given at most once and within its bound; the POST body is a form, the request carries no id_token_hint, client_id is absent, or it is the valid hint's aud, the request carries no post_logout_redirect_uri, the browser holds no live session of this realm, INTERACTION_UI_ENABLED is off (the default): the end-session route draws the step as a plain form, the person signs out of the account the request is for, when the step is answered, the client still registers the return URI and may be used, the session the step was started for is still live when the step is answered	Wait for an end-session request: GET /oauth/end-session with a query, or POST /oauth/end-session with a form, arrives Find the realm of the host: the request has its realm Count the request against the end-session limit: the address is under its limit Check the parameters against the schema: the parameters pass the schema Verify the id_token_hint, and accept it expired: the hint is read, or counted as absent Check client_id against the hint: client_id is absent or matches Check the return URI against the client's registration: there is no return URI, or it is registered Find the browser's session: the browser holds no live session: nothing to end Record that there was nothing to end: it fails, because the event store fails
Fail on a session store error no redirect, page shown	The host is a host of an enabled realm that has an issuer, the address is under its end-session limit, the request is a GET, every parameter is given at most once and within its bound; the POST body is a form, an ID token this realm issued: its signature verifies with a key of the realm's token keys (EdDSA or RS256), its iss is the realm's issuer, its typ is an ID token's, and it has not expired, client_id is absent, or it is the valid hint's aud, the request carries no post_logout_redirect_uri, the browser's session is of the account the valid hint's sub names, the hint's sid is that session's, and the client the hint was issued to is known and may be used, INTERACTION_UI_ENABLED is off (the default): the end-session route draws the step as a plain form, the person signs out of the account the request is for, when the step is answered, the client still registers the return URI and may be used, the session the step was started for is still live when the step is answered	Wait for an end-session request: GET /oauth/end-session with a query, or POST /oauth/end-session with a form, arrives Find the realm of the host: the request has its realm Count the request against the end-session limit: the address is under its limit Check the parameters against the schema: the parameters pass the schema Verify the id_token_hint, and accept it expired: the hint is read, or counted as absent Check client_id against the hint: client_id is absent or matches Check the return URI against the client's registration: there is no return URI, or it is registered Find the browser's session: the valid hint names the session's account: no confirmation is asked End the browser's session: it fails, because the session store fails
Fail on an interaction store error at the start no redirect, page shown	The host is a host of an enabled realm that has an issuer, the address is under its end-session limit, the request is a GET, every parameter is given at most once and within its bound; the POST body is a form, the request carries no id_token_hint, client_id is absent, or it is the valid hint's aud, the request carries no post_logout_redirect_uri, the browser's session is of the account the valid hint's sub names, the hint's sid is that session's, and the client the hint was issued to is known and may be used, INTERACTION_UI_ENABLED is off (the default): the end-session route draws the step as a plain form, the person signs out of the account the request is for, when the step is answered, the client still registers the return URI and may be used, the session the step was started for is still live when the step is answered	Wait for an end-session request: GET /oauth/end-session with a query, or POST /oauth/end-session with a form, arrives Find the realm of the host: the request has its realm Count the request against the end-session limit: the address is under its limit Check the parameters against the schema: the parameters pass the schema Verify the id_token_hint, and accept it expired: the hint is read, or counted as absent Check client_id against the hint: client_id is absent or matches Check the return URI against the client's registration: there is no return URI, or it is registered Find the browser's session: no valid hint names the account of the session: the person is asked Start the logout_confirm interaction: it fails, because the interaction store fails
Fail on an interaction store error at the answer or the cancel no redirect, page shown	The host is a host of an enabled realm that has an issuer, the address is under its end-session limit, the request is a GET, every parameter is given at most once and within its bound; the POST body is a form, the request carries no id_token_hint, client_id is absent, or it is the valid hint's aud, the request carries no post_logout_redirect_uri, the browser's session is of the account the valid hint's sub names, the hint's sid is that session's, and the client the hint was issued to is known and may be used, INTERACTION_UI_ENABLED is off (the default): the end-session route draws the step as a plain form, the person signs out of the account the request is for, when the step is answered, the client still registers the return URI and may be used, the session the step was started for is still live when the step is answered	Wait for an end-session request: GET /oauth/end-session with a query, or POST /oauth/end-session with a form, arrives Find the realm of the host: the request has its realm Count the request against the end-session limit: the address is under its limit Check the parameters against the schema: the parameters pass the schema Verify the id_token_hint, and accept it expired: the hint is read, or counted as absent Check client_id against the hint: client_id is absent or matches Check the return URI against the client's registration: there is no return URI, or it is registered Find the browser's session: no valid hint names the account of the session: the person is asked Start the logout_confirm interaction: the interaction is stored, and the route draws the step itself Show the confirm step as a plain form: the person presses a button: the form posts the answer Check the answer against the step's grammar: the answer passes the grammar End the interaction before anything is decided: it fails, because the interaction store fails; the turn is given back
Fail on a session store error after the interaction finished no redirect, page shown	The host is a host of an enabled realm that has an issuer, the address is under its end-session limit, the request is a GET, every parameter is given at most once and within its bound; the POST body is a form, the request carries no id_token_hint, client_id is absent, or it is the valid hint's aud, the request carries no post_logout_redirect_uri, the browser's session is of the account the valid hint's sub names, the hint's sid is that session's, and the client the hint was issued to is known and may be used, INTERACTION_UI_ENABLED is off (the default): the end-session route draws the step as a plain form, the person signs out of the account the request is for, when the step is answered, the client still registers the return URI and may be used, the session the step was started for is still live when the step is answered	Wait for an end-session request: GET /oauth/end-session with a query, or POST /oauth/end-session with a form, arrives Find the realm of the host: the request has its realm Count the request against the end-session limit: the address is under its limit Check the parameters against the schema: the parameters pass the schema Verify the id_token_hint, and accept it expired: the hint is read, or counted as absent Check client_id against the hint: client_id is absent or matches Check the return URI against the client's registration: there is no return URI, or it is registered Find the browser's session: no valid hint names the account of the session: the person is asked Start the logout_confirm interaction: the interaction is stored, and the route draws the step itself Show the confirm step as a plain form: the person presses a button: the form posts the answer Check the answer against the step's grammar: the answer passes the grammar End the interaction before anything is decided: the interaction is over Read the decision: the person signs out (logout, or logout_all, which ends the same one session today) End the session the step was started for: it fails, because the session store fails
Fail on an event store error after the interaction finished no redirect, page shown	The host is a host of an enabled realm that has an issuer, the address is under its end-session limit, the request is a GET, every parameter is given at most once and within its bound; the POST body is a form, the request carries no id_token_hint, client_id is absent, or it is the valid hint's aud, the request carries no post_logout_redirect_uri, the browser's session is of the account the valid hint's sub names, the hint's sid is that session's, and the client the hint was issued to is known and may be used, INTERACTION_UI_ENABLED is on: the ceremony app draws the step, the person signs out of the account the request is for, when the step is answered, the client still registers the return URI and may be used, the session the step was started for is still live when the step is answered	Wait for an end-session request: GET /oauth/end-session with a query, or POST /oauth/end-session with a form, arrives Find the realm of the host: the request has its realm Count the request against the end-session limit: the address is under its limit Check the parameters against the schema: the parameters pass the schema Verify the id_token_hint, and accept it expired: the hint is read, or counted as absent Check client_id against the hint: client_id is absent or matches Check the return URI against the client's registration: there is no return URI, or it is registered Find the browser's session: no valid hint names the account of the session: the person is asked Start the logout_confirm interaction: the interaction is stored, and the ceremony app draws the step Send the browser to the ceremony page of the confirm step: the ceremony page reads the step by the interaction id Return the confirm step: the person cancels, with the CSRF value of this view Cancel the interaction: the interaction is cancelled Record that the person stayed signed in: it fails, because the event store fails

Each row is also a generated test: set the starting situation, send the events, expect the ending.

What is guaranteed

These hold in all 691824 situations the model can reach, from 110592 different starting situations.

A session ends only when a valid hint names its account or the person confirmed the sign-out: a request with no valid hint, such as a cross-site image tag, ends nothing
A refused request ends no session and starts no interaction
The browser goes back only to a URI the client registered, matched exactly, while the client may still be used; with none registered it is never redirected
A person who stays signed in, or cancels, keeps the session
A client the operator did not set up is never redirected to before the browser has seen a QAuth page: the signed-out page offers its return URI as a link
The confirm step is shown only to a browser that is signed in
A POST without the session cookie is only sent again as a GET: it ends nothing and starts nothing
A request for a host QAuth does not answer for is refused before the rate limiter counts it

Exact rules

Id	Never
`nothing-ends-unless-the-hint-or-the-person-says-so`	`sessionEnded and not ((hintValid and account == 'hinted') or confirmed)`
`a-refused-request-ends-nothing`	`state in ['invalid_request.client_mismatch', 'invalid_request.return_without_client', 'invalid_request.return_not_registered', 'invalid_request.return_client_unusable'] and (sessionEnded or interactionOpen)`
`back-only-to-a-registered-uri`	`(state in ['signed_out.returned', 'nothing_to_end.returned'] and returnTo != 'registered') or (state in ['signed_out.confirmed_returned', 'nothing_to_end.finish_returned', 'stayed.returned'] and not canReturnAtFinish)`
`staying-ends-nothing`	`state in ['stayed.returned', 'stayed.page'] and sessionEnded`
`no-unseen-redirect-for-an-unvetted-client`	`state in ['signed_out.returned', 'nothing_to_end.returned'] and returnTo == 'registeredUnvetted'`
`no-step-without-a-session`	`interactionOpen and account == 'none'`
`a-post-without-the-cookie-ends-nothing`	`state == 'resent.as_get' and (sessionEnded or interactionOpen)`
`misdirected-is-not-counted`	`state == 'too_many_requests.end_session_limit' and host != 'realm'`

Reference

All transitions (64)

From	Event	Guard	To	Effects	Taken
`idle`	`END_SESSION`		`resolvingRealm`		yes
`idle`	`STATUS`		`readingStatus`		yes
`resolvingRealm`	`rule 1`	`host == 'unknown'`	`misdirected_request.host`		yes
`resolvingRealm`	`rule 2`		`rateLimiting`		yes
`rateLimiting`	`rule 1`	`overLimit`	`too_many_requests.end_session_limit`		yes
`rateLimiting`	`rule 2`		`validatingParams`		yes
`validatingParams`	`rule 1`	`params == 'malformed'`	`validation_error.params`		yes
`validatingParams`	`rule 2`	`method == 'postWithoutCookie'`	`resent.as_get`		yes
`validatingParams`	`rule 3`		`verifyingHint`		yes
`verifyingHint`	`rule 1`		`checkingClient`		yes
`checkingClient`	`rule 1`	`clientGate == 'mismatch' and hintValid`	`invalid_request.client_mismatch`		yes
`checkingClient`	`rule 2`		`checkingReturn`		yes
`checkingReturn`	`rule 1`	`returnTo == 'noClient'`	`invalid_request.return_without_client`		yes
`checkingReturn`	`rule 2`	`returnTo == 'unregistered'`	`invalid_request.return_not_registered`		yes
`checkingReturn`	`rule 3`	`returnTo == 'clientUnusable'`	`invalid_request.return_client_unusable`		yes
`checkingReturn`	`rule 4`		`findingSession`		yes
`findingSession`	`rule 1`	`account == 'none'`	`recordingNoSession`		yes
`findingSession`	`rule 2`	`account == 'hinted' and hintValid`	`endingSession`		yes
`findingSession`	`rule 3`		`startingConfirm`		yes
`recordingNoSession`	`DONE`	`canReturn`	`nothing_to_end.returned`		yes
`recordingNoSession`	`DONE`	`canOfferReturn`	`nothing_to_end.offered`		yes
`recordingNoSession`	`DONE`		`nothing_to_end.page`		yes
`recordingNoSession`	`FAIL.server`		`server_error.event_store`		yes
`endingSession`	`DONE`		`recordingSignOut`	`endSession`	yes
`endingSession`	`FAIL.server`		`server_error.session_store`		yes
`recordingSignOut`	`DONE`	`canReturn`	`signed_out.returned`		yes
`recordingSignOut`	`DONE`	`canOfferReturn`	`signed_out.offered`		yes
`recordingSignOut`	`DONE`		`signed_out.page`		yes
`recordingSignOut`	`FAIL.server`		`server_error.event_store`		yes
`startingConfirm`	`DONE`	`interactionUi == 'on'`	`atConfirmCeremony`	`openInteraction`	yes
`startingConfirm`	`DONE`		`showingConfirmPage`	`openInteraction`	yes
`startingConfirm`	`FAIL.server`		`server_error.interaction_store`		yes
`atConfirmCeremony`	`READ`		`showingStep`		yes
`showingConfirmPage`	`ANSWER`		`checkingAnswer`		yes
`showingStep`	`READ_PERSONAL`		`showingPersonal`		yes
`showingStep`	`ANSWER`		`checkingAnswer`		yes
`showingStep`	`CANCEL`		`takingCancel`		yes
`showingPersonal`	`READ`		`showingStep`		yes
`showingPersonal`	`ANSWER`		`checkingAnswer`		yes
`showingPersonal`	`CANCEL`		`takingCancel`		yes
`checkingAnswer`	`rule 1`	`decision == 'malformed'`	`invalid_answer.grammar`		yes
`checkingAnswer`	`rule 2`		`takingFinish`		yes
`takingFinish`	`DONE`		`readingDecision`	`finishInteraction`	yes
`takingFinish`	`FAIL.expired`		`interaction_expired.finished_late`		yes
`takingFinish`	`FAIL.server`		`server_error.interaction_store_at_finish`		yes
`readingDecision`	`rule 1`	`declined`	`recordingDecline`		yes
`readingDecision`	`rule 2`	`sessionAtFinish == 'ended'`	`recordingNoSessionAtFinish`		yes
`readingDecision`	`rule 3`		`endingConfirmedSession`	`confirm`	yes
`endingConfirmedSession`	`DONE`		`recordingConfirmedSignOut`	`endSession`	yes
`endingConfirmedSession`	`FAIL.server`		`server_error.session_store_at_finish`		yes
`recordingConfirmedSignOut`	`DONE`	`canReturnAtFinish`	`signed_out.confirmed_returned`		yes
`recordingConfirmedSignOut`	`DONE`		`signed_out.confirmed_page`		yes
`recordingConfirmedSignOut`	`FAIL.server`		`server_error.event_store_at_finish`		yes
`recordingNoSessionAtFinish`	`DONE`	`canReturnAtFinish`	`nothing_to_end.finish_returned`		yes
`recordingNoSessionAtFinish`	`DONE`		`nothing_to_end.finish_page`		yes
`recordingNoSessionAtFinish`	`FAIL.server`		`server_error.event_store_at_finish`		yes
`takingCancel`	`DONE`		`recordingDecline`	`finishInteraction`	yes
`takingCancel`	`FAIL.expired`		`interaction_expired.cancelled_late`		yes
`takingCancel`	`FAIL.server`		`server_error.interaction_store_at_finish`		yes
`recordingDecline`	`DONE`	`canReturnAtFinish`	`stayed.returned`		yes
`recordingDecline`	`DONE`		`stayed.page`		yes
`recordingDecline`	`FAIL.server`		`server_error.event_store_at_finish`		yes
`readingStatus`	`rule 1`	`account == 'none'`	`status.signed_out`		yes
`readingStatus`	`rule 2`		`status.signed_in`		yes