1
OIDC backchannel logout from mobile app
Source: immich-app/immich#32438 · opened by @MicDG
I have searched the existing issues, both open and closed, to make sure this is not a duplicate report. • Yes The bug Environment • iOS: 18.7 • Identity provider: Authentik 2026.8.3 • Reverse proxy: Caddy Behavior Browser logout ends the Authentik session with the provider's invalidation flow configured appropriately. Logging back in asks for credentials again. In the iOS app, logout ends the Immich session, but the next OAuth login signs in automatically using the existing Authentik session. Evidence During iOS logout, Caddy logs show a request to Authentik's OIDC discovery endpoint (shown in the attached logs) but no request to: /application/o/immich/end-session/ The mobile AuthService.logout() implementation calls the logout API and clears local data, but does not appear to follow the returned OIDC logout URL: Is provider logout intentionally unsupported on mobile? Could mobile logout optionally end the identity-provider session? The OS t…
No pledges yet. Be the first to back this.
Comments
Similar requests
RP initiated logout does not sent id_token_hint
0 votes · 0 comments
[Feature] Notification on (forced) logout
1 vote · 0 comments
UI: Use uniform language for "login", "sign out"
1 vote · 0 comments
[Feature] Use OAuth2 access_token and refresh_token
11 votes · 0 comments
[Mobile] Library page shows map and on device albums when the features are disabled.
1 vote · 0 comments
No comments yet.