title: Can't sign out from Identity Service using endsession API
body: <p>I'm executing a GET to</p>
  <blockquote>
  <p>GET https://localhost:44301/connect/endsession?id_token_hint=eyJhbGciO...GzHCPw</p>
  </blockquote>
  <p>as suggested in <a href="https://docs.identityserver.io/en/release/endpoints/endsession.html" rel="nofollow noreferrer">the docs for EndSession endpoint</a>.</p>
  <p>It seems to work (in a way) because I get a hit on my breakpoint in the method redirected to.</p>
  <pre><code>[HttpGet(&quot;logout&quot;)]
  public async Task&lt;IActionResult&gt; LogOut(
      [FromQuery] string id_token_hint,
      [FromQuery] string post_logout_redirect_uri,
      [FromQuery] string session,
      [FromQuery] string logoutId)
  { 
    LogoutRequest context = await InteractionService
      .GetLogoutContextAsync(logoutId);
    ...
  }
  </code></pre>
  <p>Here, I'm getting a value in <code>logoutId</code> (unless I skip passing the identity token, resulting i <code>null</code>), while the other variables are not set, staying as <code>null</code>. At first, I was happy to see that <code>context</code> wasn't <code>null</code>. However, I soon learned that it's set poorly, despite following <a href="https://github.com/IdentityServer/IdentityServer4.Demo/blob/main/src/IdentityServer4Demo/Quickstart/Account/AccountController.cs" rel="nofollow noreferrer">stuff that work</a>.</p>
  <p>I can see the client's name and ID (which seems to be correct). However, everything else is <code>null</code> except for the array <code>Parameters</code>, which contains zero elements.</p>
  <p>I've made sure to pass in the <strong>identity</strong> token, not <strong>access</strong> token. I've also tried the full version with all the parameters <a href="https://docs.identityserver.io/en/release/endpoints/endsession.html#parameters" rel="nofollow noreferrer">described in the docs</a> (trying various redirect URLs both mentioned in my configuration and others). The same (mis)behavior followed, though.</p>
  <blockquote>
  <p>GET https://localhost:44301/connect/endsession<br />
  ?id_token_hint=eyJhbGciO...GzHCPw<br />
  &amp;post_logout_redirect_uri=https://get_the_duck.off<br />
  &amp;session=1337</p>
  </blockquote>
  <p>Since I'm getting the breaky hit and recieve some value as <code>logoutId</code> parsable by the interaction service, I feel that it's wired up correctly (which is expected since the security as such works as expected). However, my application seem to be a stalker and just <em>won't let them go</em>, so to speak. I suspect, there's some tiny detail that the docs don't mention (or obscures in a formulation I don't comprehend). (Googling gave nothing I recognized as relevant.)</p>
  <p>Proof of effort (along a bunch of blogs on security, not dedicated to the signout specifically).</p>
  <ul>
  <li><a href="https://stackoverflow.com/questions/52374887/signing-out-of-identity-server">Old .NET, no answer</a>.</li>
  <li><a href="https://stackoverflow.com/questions/21218027/asp-net-identity-sign-out-all-sessions">Wrong platform</a></li>
  <li><a href="https://stackoverflow.com/questions/61250964/calling-appauth-sign-out-endsession-endpoint-using-identityserver4-in-flutter">Already tried, also not .NET Core</a></li>
  <li><a href="https://stackoverflow.com/questions/38518457/cant-sign-out-web-api-using-owin">Unrelated, even if it sound like so</a></li>
  <li><a href="https://stackoverflow.com/questions/18431598/identity-server-single-sign-out-logout-from-server-too">Waaay too old</a></li>
  </ul>