{"action":"opened","issue":{"url":"https://api.github.com/repos/mozilla/fxa-content-server/issues/2474","labels_url":"https://api.github.com/repos/mozilla/fxa-content-server/issues/2474/labels{/name}","comments_url":"https://api.github.com/repos/mozilla/fxa-content-server/issues/2474/comments","events_url":"https://api.github.com/repos/mozilla/fxa-content-server/issues/2474/events","html_url":"https://github.com/mozilla/fxa-content-server/issues/2474","id":80821641,"number":2474,"title":"Solve the logout-from-rp problem, to improve session management","user":{"login":"rfk","id":34695,"avatar_url":"https://avatars.githubusercontent.com/u/34695?v=3","gravatar_id":"","url":"https://api.github.com/users/rfk","html_url":"https://github.com/rfk","followers_url":"https://api.github.com/users/rfk/followers","following_url":"https://api.github.com/users/rfk/following{/other_user}","gists_url":"https://api.github.com/users/rfk/gists{/gist_id}","starred_url":"https://api.github.com/users/rfk/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rfk/subscriptions","organizations_url":"https://api.github.com/users/rfk/orgs","repos_url":"https://api.github.com/users/rfk/repos","events_url":"https://api.github.com/users/rfk/events{/privacy}","received_events_url":"https://api.github.com/users/rfk/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2015-05-26T06:37:50Z","updated_at":"2015-05-26T06:37:50Z","closed_at":null,"body":"As noted in https://github.com/mozilla/fxa-content-server/issues/2391#issuecomment-100356118 and linked issues, we don't have a great story around logout and session management right now.\r\n\r\nThe crux of the issue is, there's no obvious way for the user to log out of FxA.  Oh sure, we provide a \"sign out\" option, but most users never see it since they only pass through FxA on their way to something else.\r\n\r\nWe work around this by refusing to re-use FxA session tokens from one login to the next, except under very controlled circumstances.  The rule we're operating by is:  **if logging in to ServiceA via FxA leaves you with password-less login to other FxA services, then logging out of ServiceA should revoke it.**\r\n\r\nThe result right now is that only sync can grant you password-less login to other FxA services, and even then under some pretty tenuous circumstances.  Since we want more paswordless login, we need to do more logouts.\r\n\r\nPerhaps we can lift ideas from the OpenID Connect world on how to enable this?  Relevant Draft RFCs:\r\n\r\n    http://openid.net/specs/openid-connect-session-1_0.html\r\n    http://openid.net/specs/openid-connect-logout-1_0.html\r\n\r\nBoth of these suggest that the IdP offer an `end_session_endpoint` to which reliers can redirect in order to effect a logout.  With cooperation from the RP, this might be enough to allow e.g. Hello or Pocket logins to satisfy the rule above."}}