Or you could let the sso provider take the responsibility?
When logging in you also get a ,logouturl=http://mysso/logout.aspx?mypayload=xyz in the sso package.
It’s then up to the provider to decide how he want’s it implemented.
If non-secure a userid in his return url could suffice for him
logouturl=http://mysso/logout.aspx?uid=46732
If encrypted wityh the same secret it could be
logouturl=http://mysso/logout.aspx?sso=xxxxxxx
and up to him if there is a userid or perhaps even login datetime information. But he has already encrypted the sso part when giving it to you so he could even use another secret if he wants. You just return using what was given. I don’t even think there would be a reason to add some expiry datetime info in your direction, just return the stuff if you can catch the logout.