https://descope.com logo
Join Slack
Powered by
I have a federated app, generic OIDC application, ...
# ask-a-descoper
d
I have a federated app, generic OIDC application, when I set backchannel logout I receive an error 
{"errorCode":"E066011","errorDescription":"Failed to perform OIDC back channel logout request","errorMessage":"request failed","message":"request failed"}
There no audit logs, my endpoint is public and sends reponse 200 OK https://ca-chassis-dev.agreeablesmoke-8028d3df.westeurope.azurecontainerapps.io/descope-logout-ok AI support continue saying same advices with no effect, does anyone know how I can get a human being involved?
āœ… 1
d
Backchannel Logout Configuration Issue The E066011 error indicates Descope cannot successfully reach your backchannel logout endpoint. Even though your endpoint returns 200 OK, there are several potential causes: Common Issues 1. Content-Type mismatch - Your endpoint must accept 
application/x-www-form-urlencoded
requests 2. Request validation - The endpoint should validate the 
logout_token
parameter in the POST body 3. Response requirements - Must return exactly 200 or 204 status with no response body 4. Network connectivity - Descope servers must be able to reach your endpoint from their infrastructure Endpoint Requirements Your backchannel logout endpoint should:
Copy code
<http://app.post|app.post>('/descope-logout-ok', (req, res) => {
  // Validate logout_token parameter exists
  const logoutToken = req.body.logout_token;
  if (!logoutToken) {
    return res.status(400).send();
  }
  
  // Process logout (invalidate sessions, etc.)
  
  // Return 200 with no body
  res.status(200).send();
});
Troubleshooting Steps 1. Verify your endpoint accepts POST requests with 
Content-Type: application/x-www-form-urlencoded
2. Check that the 
logout_token
parameter is being received and processed 3. Ensure no response body is returned (empty 200/204 response) 4. Test endpoint accessibility from external networks The backchannel logout URL configuration can be found in your OIDC application settings . Since you've already worked with AI support without resolution and this appears to be a production-blocking issue, you can reach support directly at support.descope.com. Load Application by ID | API Reference | Descope Documentation
d
you can test the endpoint, I have already done all the checks
d
I'm connecting you with a member of the Descope support team now or you can also reach support directly at support.descope.com.
a
Hey diana whats the project id?
d
Peuc13ANrrVqtOsp6Oh4yySu5fR1lKW8
a
Could you share the code snippet that handles the back channel logout URL? Also your seeing this error immediately after the user logs out ? as in when descope sends the back-channel logout request?
d
Copy code
<http://app.post|app.post>("/descope-logout-ok", (req, res) => {
  console.log("Received request for POST /descope-logout with body:");
  // Here you would handle the logout logic, such as clearing cookies or session data

  console.log("Headers:", req.headers);
  console.log("Body:", req.body);
  console.log("Query:", req.query);

  res.status(200).send("OK");
});
šŸ‘€ 1
yes, immediately after logout, when I initiate logout the end user endpoint is called by my openid client library: https://api.euc1.descope.com/oauth2/v1/logout?post_logout_redirect_uri=http%3A%2F%2Floc[ā€¦]-GLec8q5yY_H1s&amp;x-client-SKU=ID_NET9_0&amp;x-client-ver=8.0.1.0
Copy code
"end_session_endpoint": "<https://api.euc1.descope.com/oauth2/v1/logout>",
if I don't set backchannel logout url everything works correctly
a
Hey Diana, thanks for the details. Looking at your endpoint, I think I spotted the issue. You're returning 
res.status(200).send("OK")
, but the OIDC Back-Channel Logout spec actually requires a 200 with an empty body. Sending 
"OK"
as the body could be causing Descope to treat the response as malformed and throw that E066011. Worth trying this quick fix:
Copy code
res.status(200).send(); // or res.status(204).send()
A couple of other things to check while you're at it: ā€¢ You can check your server logs to confirm Descope's request is actually hitting the endpoint ā€” if you're seeing no logs at all, that would point to a network/connectivity issue on the Azure Container Apps side rather than a code issue Give the empty body fix a shot first and let us know if that helps
d
I have tried it too, also I have checked that I receive the token
I will make the change, but is there any way to see the actual error at your side?
a
i can see the logs on my side but can you trigger the error once again so i can confirm the exact problem?
d
done
a
got it
Logs - [E064001] JWT Expired due to logout: JWT token expired by logout [E061005] Invalid token: Failed to validate DSR for OIDCAuthZEndpointFinish endpoint [E061004] Unauthorized request: Failed to handle OIDCAuthZEndpointFinish request [E064001] JWT Expired due to logout: JWT token expired by logout [error: rpc error: code = Unknown desc = [E064001] JWT Expired due to logout: JWT token expired by logout]
Let me check the problem with these Ill update here
gratitude thank you 1
r
Hi Diana, We've investigated the logs on our end and identified the issue. There appears to be a problem with the session token lifecycle during the logout flow ā€” the token is being invalidated before the back-channel logout notification can be dispatched to your endpoint. We've escalated this to our engineering team and will keep you updated on the resolution.
šŸ™Œ 1
d
Great, thanks
hey, any update on this?
a
Hey @diana sotirova, a GH issue has been raised. We'll send a message here once there is an update
d
can i have a link to the GH issue?
a
the issue is from an internal repo so its not accessible to customers rest assured i am keeping tabs on it so i can update here
šŸ™Œ 1
2 Views
Open in Slack
PreviousNext
Powered by