Class BffLogoutCoordinator

java.lang.Object

io.fluxzero.idp.bff.session.BffLogoutCoordinator

public final class BffLogoutCoordinator
extends Object

Local application logout and session-required back-channel logout. Never logs out the OP itself.

Method Summary

Modifier and Type	Method	Description
void	backchannel(String compactToken)	Requires registration with backchannel_logout_session_required=true.
boolean	local(BrowserHandle cookie, BrowserSessionBoundary boundary, String method, List<String> origins, List<String> csrfHeaders, String fetchSite)	Removes only this application cookie's server-side session.

Methods inherited from class Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Method Details

backchannel

public void backchannel(String compactToken)

Requires registration with backchannel_logout_session_required=true. Caller supplies protected, bounded POST ingress and rejects duplicate logout_token parameters. No browser cookie authority. Returning normally means both replay receipt and RP fence committed, including identical retries.

local

public boolean local(BrowserHandle cookie,
 BrowserSessionBoundary boundary,
 String method,
 List<String> origins,
 List<String> csrfHeaders,
 String fetchSite)

Removes only this application cookie's server-side session. No refresh, token egress or OP logout. An absent/inactive session returns false without mutation. HTTP may clear that stale cookie after validating the browser origin; storage failures propagate and must not be treated as absence.