Local logout only: revokes our session and clears our cookie. The IdP's

POST

/auth/logout

curl --request POST \
  --url http://localhost:3001/auth/logout \
  --header 'Authorization: Bearer <token>'

use reqwest;

#[tokio::main]
pub async fn main() {
    let url = "http://localhost:3001/auth/logout";

    let mut headers = reqwest::header::HeaderMap::new();
    headers.insert("Authorization", "Bearer <token>".parse().unwrap());

    let client = reqwest::Client::new();
    let response = client.post(url)
        .headers(headers)
        .send()
        .await;

    let status = response.unwrap().status();

    dbg!(status);
}

Own session is deliberately left alone — RP-initiated logout (redirecting to the provider’s end_session_endpoint) is not implemented, so signing out of the OMS does not sign the user out of their other applications.

Reads the raw cookie itself rather than requiring Extension<AuthContext> so it stays idempotent: a missing, already-revoked, or expired session still gets a clear_cookie_header in the response instead of a 401.

Responses

204

Session revoked and cookie cleared (idempotent)