# More secure logout redirection

**URL:** <https://meta.discourse.org/t/more-secure-logout-redirection/28795>\
**Category:** Feature\
**Tags:** sso, discourseconnect\
**Created:** [14 مايو 2015، 2:37ص UTC](https://meta.discourse.org/t/more-secure-logout-redirection/28795 "2015-05-14T02:37:59Z")\
**Posts on this page:** 1\
**Showing post:** 1

<div class="post-metadata">

**Author:** ![erik](https://avatars.discourse-cdn.com/v4/letter/e/b5ac83/32.png) [@erik](https://meta.discourse.org/u/erik)\
**Post date:** [14 مايو 2015، 2:37ص UTC](https://meta.discourse.org/t/more-secure-logout-redirection/28795/1 "2015-05-14T02:37:59Z")

</div>

I want the user’s session in my SSO provider to be killed when a user clicks ‘Log Out’, but the current logout redirection feature doesn’t quite fit the bill because I have no way of knowing if the ensuing GET to the logout page was intentional or the result of a low-effort CSRF. (I do consider drive-by logouts from my provider to be a security problem.)

From the perspective of the SSO provider (on the server), I want to authenticate that the user has _deliberately_ ended their Discourse session.

There are two approaches that come to mind:

1. Add a SSO Secret-signed bearer proof to the URL the user is redirected to.
2. Allow the SSO provider to query Discourse for the liveness of the user’s session.

My instinct is that the first approach is complicated to get right.

The second might be _really_ easy, depending on how Discourse stores sessions. (I haven’t looked.) Ideally, I could just hit an (authenticated) admin API endpoint with the nonce from the login and find out of the session created from that nonce is alive.

---

_[View the full topic](https://meta.discourse.org/t/more-secure-logout-redirection/28795)._