title: OIDC Session Management in a SPA (Single-Sign-Out)
body: <p>I am currently implementing SSO on multiple applications using OIDC. I am not sure how to handle single-sign-out in a Single-Page App (SPA) for token-based authentication.</p>
  
  <p>Consider two applications. Application A is a standard Spring MVC application that uses the OAuth2 Authorization Code flow, and application B is a SPA using the implicit flow. If a user has signed into Application A, when they navigate to Application B they are automatically signed in via SSO, which is to be expected. However, If the user logs out of Application A and then navigates to application B, currently app B still loads and allows access to apis because it has a valid OAuth2 access token stored in browser local storage. I would like application B to require the user to re-authenticate before making any other requests.</p>
  
  <p>What is the recommended approach for doing single sign out in a SPA, since there is no way to have the identity provider send a 'signout' request to a server endpoint? </p>
  
  <p>A couple of possible solutions I have thought of are:</p>
  
  <ol>
  <li>Create one-time-use access tokens that must be re-generated with every request.</li>
  <li>Check for an active IDP session any time Application B wants to make a request to our apis.</li>
  </ol>
  
  <p>I am hesitant to use either of those two solutions because they require an additional request to the IDP any time the user interacts with the app. Are the any other strategies to solve this problem?</p>
  
  <p><strong>Edit</strong></p>
  
  <p>Thanks to sdoxsee for the answer which brought out the need for more clarification. I should have mentioned that logging out of either Application A or Application B also logs the user out of the IDP session. However, because application B has a valid access token in browser local storage, when the user navigates to app B, they will still be 'signed in' to app B <em>despite</em> not having an active IDP session. Hopefully that provides some more clarification.  </p>