I have a mobile application that a user signs into using OpenId Connect and OAuth 2.0. Currently when the user logs out, I open up a webpage to the end_session_endpoint (http://docs.identityserver.io/en/latest/endpoints/endsession.html), the user clicks sign out, and the token is invalidated.

Can I do this without user interaction? I understand that there may be a way to non-interactively end the session, but what if I don’t even end the session? What is the security implication of just forgetting the tokens in the mobile app? They will presumably remain valid until they expire, which is currently ~10 days.

1 Answer 1


The answer to most "is it safe to ...?" questions is: It depends based on your threat model.

For most business scenarios I would say not invalidating the session is a bad idea due to session hijacking attacks, 8-12 hours is enough for a session considering business hours.

However since OAuth 2.0 is also being used in this scenario for authentication, there is an additional layer for the attacker (considering the attacker does not already have a valid OAuth token).

In the end we will not be able to provide a clear/direct answer since we do not have the threat model, I can only give an educated assumption based on how little I know about the entirety of this scenario. Leaving valid sessions in the backend is not a good idea for most cases so I will recommend against it. It's better to define proper rules for ending/invalidating unused user sessions, and prompting again for authentication.

Cheers, Filipe

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .