Sign out does not clear SSO token

Looking at the code, I don’t see Sign Out being properly implemented. There is a way to remove the user tokens from the local cache, but it does not appear to invoke the system web view to hit the end_session_endpoint endpoint value. That may leave the cookie between the system and the device valid such that a subsequent authenticate call may not prompt for credentials.

Seems like the end_session_endpoint value should be read from the OIDC metadata and then invoked on a sign out?

[frolific]

Any update on this? IMO, this should not be marked as an enhancement - it’s a defect that can potentially lead to PII issues.

[bgavrilMS]

Hi @shripathi-kamath - you have some control over the browser by using the .WithPrompt method. AFAIK Prompt.ForceLogin will always force the user to enter their password.

var result = await pca.AcquireTokenInteractive(_scopes)
                        .WithPrompt(Prompt.ForceLogin)
                        .ExecuteAsync()