# Foundry OAuth when using OSDK : Logout issue **URL:** \ **Category:** Ask the Community\ **Tags:** osdk, authentication\ **Created:** [November 6, 2024, 10:32am UTC](https://community.palantir.com/t/foundry-oauth-when-using-osdk-logout-issue/1768 "2024-11-06T10:32:59Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![alaa-patient1st](https://avatars.discourse-cdn.com/v4/letter/a/87869e/32.png) [@alaa-patient1st](https://community.palantir.com/u/alaa-patient1st)\ **Post date:** [November 6, 2024, 10:32am UTC](https://community.palantir.com/t/foundry-oauth-when-using-osdk-logout-issue/1768/1 "2024-11-06T10:32:59Z")
Hi there ! We’re using foundry as a backend for some client apps. When trying to implement a logout, I’ve found the following endpoint: `/multipass/api/logout` Unfortunately, this endpoint doesn’t handle redirections as per [OpenID Connect’s standards](https://openid.net/specs/openid-connect-rpinitiated-1_0.html) (for example using `post_logout_redirect_uri`). This leaves the user with a browser page that never closes, which is less than ideal especially on native mobile apps. Is this something that could be implemented ? If not, is there any way around this currently ? Thanks a lot ! ---
**Author:** ![astanciu](https://avatars.discourse-cdn.com/v4/letter/a/d26b3c/32.png) [@astanciu](https://community.palantir.com/u/astanciu)\ **Post date:** [December 3, 2024, 6:39pm UTC](https://community.palantir.com/t/foundry-oauth-when-using-osdk-logout-issue/1768/2 "2024-12-03T18:39:54Z")
Hi! Are you able to share the request the client app is making to Foundry and the response it is receiving? ---
**Author:** ![alaa-patient1st](https://avatars.discourse-cdn.com/v4/letter/a/87869e/32.png) [@alaa-patient1st](https://community.palantir.com/u/alaa-patient1st)\ **Post date:** [December 3, 2024, 8:53pm UTC](https://community.palantir.com/t/foundry-oauth-when-using-osdk-logout-issue/1768/3 "2024-12-03T20:53:46Z")
Thanks for replying ! Um it’s all quite fast browser-based redirections so I don’t really have much as it’s happening outside the app. Here’s how it goes: - Client (mobile) app opens a browser window with `foundry_url/multipass/api/logout` - This then redirects to `https://auth.patient1st.ai/.../logout` (which is our configured identity provider) - Which after successfully logging out redirects to `foundry_url/multipass/goodbye` Since there’s no redirection back to the app (as it appears that the initial endpoint doesn’t accept any post logout redirect uri), the browser window stays open on top of the app. Everything is happening in a browser the app opens not much info about the exact payloads (unless I setup some kind of proxy tool to inspect traffic, but hopefully there’s no need to 😆) ---
**Author:** ![astanciu](https://avatars.discourse-cdn.com/v4/letter/a/d26b3c/32.png) [@astanciu](https://community.palantir.com/u/astanciu)\ **Post date:** [December 4, 2024, 9:51pm UTC](https://community.palantir.com/t/foundry-oauth-when-using-osdk-logout-issue/1768/4 "2024-12-04T21:51:45Z")
This is helpful, thank you! Indeed this is a non-ideal UX, thanks for putting it on our radar! Unfortunately, as you mentioned, the end of the OIDC session will always be followed by a redirect to `multipass/goodbye` and there is currently no work-around in foundry - the client would need to manage the logout window somehow. ---
**Author:** ![alaa-patient1st](https://avatars.discourse-cdn.com/v4/letter/a/87869e/32.png) [@alaa-patient1st](https://community.palantir.com/u/alaa-patient1st)\ **Post date:** [December 5, 2024, 9:22am UTC](https://community.palantir.com/t/foundry-oauth-when-using-osdk-logout-issue/1768/5 "2024-12-05T09:22:00Z")
My pleasure ! I have a few workarounds in mind such as using timeouts to close the opened window, etc. But I’d like to avoid implementing them as it might creates some issues specially on iOS devices (mobile context). Do you think that a `post_logout_redirect_uri` (as per OIDC standards - link in my initial post) can be implemented on Foundry’s side in the foreseeable future ? Thanks a lot ! ---
**Author:** ![astanciu](https://avatars.discourse-cdn.com/v4/letter/a/d26b3c/32.png) [@astanciu](https://community.palantir.com/u/astanciu)\ **Post date:** [December 5, 2024, 8:03pm UTC](https://community.palantir.com/t/foundry-oauth-when-using-osdk-logout-issue/1768/6 "2024-12-05T20:03:14Z")
Just to clarify, based on my understanding of the specs you linked, the RP (in this case foundry/multipass) will call the OP’s (OpenID Provider) logout endpoint with`post_logout_redirect_uri` set to the foundry goodbye page. This is all working as expected. The FR we’re tracking is a custom goodbye page which would definitely help developers. Unfortunately, we are not planning to implement this in the near future. ---
**Author:** ![alaa-patient1st](https://avatars.discourse-cdn.com/v4/letter/a/87869e/32.png) [@alaa-patient1st](https://community.palantir.com/u/alaa-patient1st)\ **Post date:** [December 6, 2024, 11:08am UTC](https://community.palantir.com/t/foundry-oauth-when-using-osdk-logout-issue/1768/7 "2024-12-06T11:08:49Z")
Um what I’m suggesting is making the `/multipass/logout` endpoint accept a `post_logout_redirect_uri` (which can default to the goodbye page). And if present, redirect to it instead of the goodbye page. Because for now we can’t really implement a logout in our mobile apps, which can be an issue for our users 😕 ---
**Author:** ![jackmiller2003](https://yyz1.discourse-cdn.com/palantir/user_avatar/community.palantir.com/jackmiller2003/32/1695_2.png) [@jackmiller2003](https://community.palantir.com/u/jackmiller2003)\ **Post date:** [May 22, 2025, 12:33pm UTC](https://community.palantir.com/t/foundry-oauth-when-using-osdk-logout-issue/1768/8 "2025-05-22T12:33:08Z")
Just wanting to +1 this as well. Would be super helpful for our use case!! ---
**Author:** ![pkoenig](https://yyz1.discourse-cdn.com/palantir/user_avatar/community.palantir.com/pkoenig/32/49_2.png) [@pkoenig](https://community.palantir.com/u/pkoenig)\ **Post date:** [January 12, 2026, 3:18pm UTC](https://community.palantir.com/t/foundry-oauth-when-using-osdk-logout-issue/1768/9 "2026-01-12T15:18:23Z")
> Um what I’m suggesting is making the `/multipass/logout` endpoint accept a `post_logout_redirect_uri` (which can default to the goodbye page). And if present, redirect to it instead of the goodbye page. It’s not clear to me what you mean by “accept” here. If you’re suggesting that the logout endpoint accept a query parameter indicating a URL to redirect to after the logout is complete, we’re not going to do that. This is a classic open redirect vulnerability. https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated\_Redirects\_and\_Forwards\_Cheat\_Sheet.html If we were to add a support for this in the future, it would like be some enrollment/organization/host setting that is configured in Control Panel. * * * That being said: > When trying to implement a logout, I’ve found the following endpoint: > > `/multipass/api/logout` This logout endpoint is the non-public first-party logout endpoint to log users out of the Foundry first-party application. It is not designed or intended to be used by third-party applications. We make no guarantees about it’s stability and reserve the right to change the behavior at any time. We do not support logging users out of Foundry from a third-party application. This is standard behavior for OAuth2 application (ex. an application using OAuth2 with Google cannot log a user out of their Google account).