Single sign-out

Single sign-out

Single sign-out is a feature that allows users to sign out of the application in one tab/browser and have the same user session invalidated in other tabs/browsers.

This is useful for compliance purposes, as it ensures that if a user signs out of the application, the session will be invalidated across all devices.

How it works

Single sign-out registers a plugin in the client that subscribes to a server sent event endpoint on the server. This endpoint is used to send a message to the client when the user signs out in a different tab/browser.

The feature uses a unique session ID to track related sessions across tabs/browsers. When a user signs out:

1. The user logs out
2. The server invalidates the session
3. A message is broadcast to all connected clients with the same session ID
4. Clients receiving the message log out as well
5. When a user reconnects with an old session, the plugin will automatically invalidate sessions that may still be active in the browser

If there is no refresh token, meaning there is no persistent session, single sign-out will only work in the same browser and with the same session.

Event stream authorization

The /api/_auth/sso event stream accepts only a valid sealed session cookie for a configured provider whose current session has singleSignOut: true. With expiration checks enabled, definitively expired non-refreshable sessions receive 401; sessions with expiration checks disabled, or expired refreshable sessions with automatic refresh enabled, continue through normal session handling. Refreshable sessions must also satisfy the configured missing-persistent-session policy. Invalid or otherwise ineligible requests receive 401 before an event stream is opened.

Local session-error and logout redirects include Nuxt's configured app.baseURL. For example, an application mounted at /portal/ returns to /portal/ rather than the origin root.

Configuration

Example configuration in nuxt.config.ts with Keycloak provider:

      keycloak: {
        baseUrl: '',
        clientId: '',
        clientSecret: '',
        redirectUri: 'http://localhost:3000/auth/keycloak/callback',
        userNameClaim: 'preferred_username',
        logoutRedirectUri: 'http://localhost:3000',
        // Single sign-out
        sessionConfiguration: {
          singleSignOut: true,
          singleSignOutIdField: 'sub',
        },
      },

Options

Provider Support

Single sign-out is supported by all providers that issue refresh tokens. The feature requires a persistent session to work across browsers.