Logout issue
I'm using OIDC with oidc-client
in an Angular app, logging in via Microsoft Identity Platform (v2.0 endpoint). The login works perfectly, but after calling the logout URL with id_token_hint
, the user is redirected to the Microsoft logout page. After logout, when they revisit the app, Microsoft logs them in silently without prompting for credentials again.
I also notice the logout process often shows an email/account picker, even though I want to fully sign out without that step.
Steps to reproduce:
Login with Microsoft SSO via oidc-client
Call https://login.microsoftonline.com/common/oauth2/v2.0/logout?id_token_hint=...
Expect full sign out, but Microsoft retains the session
How can we ensure complete logout, including clearing session cookies?