I have a mobile application that a user signs into using OpenId Connect and OAuth 2.0. Currently when the user logs out, I open up a webpage to the
end_session_endpoint (http://docs.identityserver.io/en/latest/endpoints/endsession.html), the user clicks sign out, and the token is invalidated.
Can I do this without user interaction? I understand that there may be a way to non-interactively end the session, but what if I don’t even end the session? What is the security implication of just forgetting the tokens in the mobile app? They will presumably remain valid until they expire, which is currently ~10 days.