How is logout really working and can we bypass the logout-confirm page?

Tips and tricks
2

Hello,

Keycloak recently changed the logout behavior as documented in this blog post on Keycloak 18.0.0.

You now have to provide additonal URL parameters when you invoke the endsession endpoint:
https://www.keycloak.org/docs/latest/server_admin/#_oidc-logout

  • id_token_hint = idtoken received by your client
  • post_logout_redirect_uri = url where you want to go after logout

For example in some SPAs that use keycloak.js I provide the required URL parameters as follows:

        // workaround for changes with oidc logout in Keycloak 18.0.0
        // See https://www.keycloak.org/docs/latest/upgrading/index.html#openid-connect-logout
        keycloak.createLogoutUrl = function(options) {
            return keycloak.endpoints.logout()
                + '?id_token_hint=' + keycloak.idToken
                + '&post_logout_redirect_uri=' + encodeURIComponent(window.location.href);
        }

Cheers,
Thomas