Re: [OAUTH-WG] What Does Logout Mean?

[Bill Burke <[e-mail]>]

On Wed, Mar 28, 2018 at 1:40 PM, Richard Backman, Annabelle <
[e-mail]> wrote:

> I'm reminded of this session from IIW 21
> <http://iiw.idcommons.net/What_Does_%E2%80%9CLogOUT%E2%80%99_mean%3F>. ☺
> I look forward to reading the document distilling the various competing use
> cases and requirements into some semblance of sanity.
>
>
>
> > If the framework has no way of invalidating a session across the cluster…
>
>
>
> Is this a common deficiency in application frameworks? It seems to me that
> much of the value of a server-side session record is lost if its state
> isn’t synchronized across the fleet.
>
>
>
"modern" apps are REST based with Javascript frontends, but there's still a
ton of "old school" developers out there.

Was involved with developing an application server for over a decade
(JBoss)...There were many app developers that didn't want to store app
session information in a database (as David says) or deal with the
headaches of session replication so they just set up their load balancer to
do session affinity (sticky sessions).  That way the login session was
always local.  If the oidc logout spec allowed the client to register
logout callback tied to the token's session (like maybe during code to
token), that might be a simple way to solve many of these issues too.