FeatureFuel
1

OIDC backchannel logout from mobile app

Source: immich-app/immich#32438 · opened by @MicDG
I have searched the existing issues, both open and closed, to make sure this is not a duplicate report. • Yes The bug Environment • iOS: 18.7 • Identity provider: Authentik 2026.8.3 • Reverse proxy: Caddy Behavior Browser logout ends the Authentik session with the provider's invalidation flow configured appropriately. Logging back in asks for credentials again. In the iOS app, logout ends the Immich session, but the next OAuth login signs in automatically using the existing Authentik session. Evidence During iOS logout, Caddy logs show a request to Authentik's OIDC discovery endpoint (shown in the attached logs) but no request to: /application/o/immich/end-session/ The mobile AuthService.logout() implementation calls the logout API and clears local data, but does not appear to follow the returned OIDC logout URL: Is provider logout intentionally unsupported on mobile? Could mobile logout optionally end the identity-provider session? The OS t…

No pledges yet. Be the first to back this.

Make a pledge

Pledge your monetary support if this feature is added.

$

Comments

No comments yet.

Replying to

Add a comment

What do you think about this feature request?


Similar requests