@@ -334,15 +334,15 @@ func (p *OAuthProxy) buildProxySubrouter(s *mux.Router) {
334334 s.Use(prepareNoCacheMiddleware)
335335
336336 s.Path(signInPath).HandlerFunc(p.SignIn)
337− s.Path(signOutPath).HandlerFunc(p.SignOut)
338337 s.Path(oauthStartPath).HandlerFunc(p.OAuthStart)
339338 s.Path(oauthCallbackPath).HandlerFunc(p.OAuthCallback)
340339
341340 // Static file paths
342341 s.PathPrefix(staticPathPrefix).Handler(http.StripPrefix(p.ProxyPrefix, http.FileServer(http.FS(staticFiles))))
343342
344− // The userinfo endpoint needs to load sessions before handling the request
343+ // The userinfo and logout endpoints needs to load sessions before handling the request
345344 s.Path(userInfoPath).Handler(p.sessionChain.ThenFunc(p.UserInfo))
345+ s.Path(signOutPath).Handler(p.sessionChain.ThenFunc(p.SignOut))
346346}
347347
348348// buildPreAuthChain constructs a chain that should process every request before
@@ -746,9 +746,43 @@ func (p *OAuthProxy) SignOut(rw http.ResponseWriter, req *http.Request) {
746746 p.ErrorPage(rw, req, http.StatusInternalServerError, err.Error())
747747 return
748748 }
749+
750+ p.backendLogout(rw, req)
751+
749752 http.Redirect(rw, req, redirect, http.StatusFound)
750753}
751754
755+func (p *OAuthProxy) backendLogout(rw http.ResponseWriter, req *http.Request) {
756+ session, err := p.getAuthenticatedSession(rw, req)
757+ if err != nil {
758+ logger.Errorf("error getting authenticated session during backend logout: %v", err)
759+ return
760+ }
761+
762+ if session == nil {
763+ return
764+ }
765+
766+ providerData := p.provider.Data()
767+ if providerData.BackendLogoutURL == "" {
768+ return
769+ }
770+
771+ backendLogoutURL := strings.ReplaceAll(providerData.BackendLogoutURL, "{id_token}", session.IDToken)
772+ // security exception because URL is dynamic ({id_token} replacement) but
773+ // base is not end-user provided but comes from configuration somewhat secure
774+ resp, err := http.Get(backendLogoutURL) // #nosec G107
775+ if err != nil {
776+ logger.Errorf("error while calling backend logout: %v", err)
777+ return
778+ }
779+
780+ defer resp.Body.Close()
781+ if resp.StatusCode != 200 {
782+ logger.Errorf("error while calling backend logout url, returned error code %v", resp.StatusCode)
783+ }
784+}
785+
752786// OAuthStart starts the OAuth2 authentication flow
753787func (p *OAuthProxy) OAuthStart(rw http.ResponseWriter, req *http.Request) {
754788 // start the flow permitting login URL query parameters to be overridden from the request URL