{"action":"created","issue":{"url":"https://api.github.com/repos/IdentityServer/Thinktecture.IdentityServer3/issues/862","labels_url":"https://api.github.com/repos/IdentityServer/Thinktecture.IdentityServer3/issues/862/labels{/name}","comments_url":"https://api.github.com/repos/IdentityServer/Thinktecture.IdentityServer3/issues/862/comments","events_url":"https://api.github.com/repos/IdentityServer/Thinktecture.IdentityServer3/issues/862/events","html_url":"https://github.com/IdentityServer/Thinktecture.IdentityServer3/issues/862","id":56334756,"number":862,"title":"EndSessionRequestValidator Log Non-authenticated as Warnings","user":{"login":"parkinsona","id":8508456,"avatar_url":"https://avatars.githubusercontent.com/u/8508456?v=3","gravatar_id":"","url":"https://api.github.com/users/parkinsona","html_url":"https://github.com/parkinsona","followers_url":"https://api.github.com/users/parkinsona/followers","following_url":"https://api.github.com/users/parkinsona/following{/other_user}","gists_url":"https://api.github.com/users/parkinsona/gists{/gist_id}","starred_url":"https://api.github.com/users/parkinsona/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/parkinsona/subscriptions","organizations_url":"https://api.github.com/users/parkinsona/orgs","repos_url":"https://api.github.com/users/parkinsona/repos","events_url":"https://api.github.com/users/parkinsona/events{/privacy}","received_events_url":"https://api.github.com/users/parkinsona/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2015-02-03T05:12:49Z","updated_at":"2015-02-03T22:01:04Z","closed_at":null,"body":"Hi,\r\n\r\nWhen a user logs out from an active RP session, but their idsvr cookie is expired I am getting the following event logged: \"User is anonymous. Aborting logout.\"\r\n\r\nI am using log4net, and have a logger that emails any ERROR level events.\r\nShould this be an error or a Warning?\r\n\r\n```c#\r\nif (!subject.Identity.IsAuthenticated)\r\n            {\r\n                Logger.Error(\"User is anonymous. Aborting logout.\");\r\n                return Invalid();\r\n            }\r\n```\r\n\r\nI also noticed that the way this message is logged is different from others in ValidateAsync.\r\nIs it possible to have the post logout redirect URIs evaluated before returning Invalid(); ??\r\nIt would be handy to have the Redirect Link displayed regardless of the user being current. I'm not sure if this presents a security issue though. The post logout redirect uri value is still available in this method regardless of if the user is currently Authenticated.\r\n\r\n\r\n\r\n\r\n\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/IdentityServer/Thinktecture.IdentityServer3/issues/comments/72744533","html_url":"https://github.com/IdentityServer/Thinktecture.IdentityServer3/issues/862#issuecomment-72744533","issue_url":"https://api.github.com/repos/IdentityServer/Thinktecture.IdentityServer3/issues/862","id":72744533,"user":{"login":"parkinsona","id":8508456,"avatar_url":"https://avatars.githubusercontent.com/u/8508456?v=3","gravatar_id":"","url":"https://api.github.com/users/parkinsona","html_url":"https://github.com/parkinsona","followers_url":"https://api.github.com/users/parkinsona/followers","following_url":"https://api.github.com/users/parkinsona/following{/other_user}","gists_url":"https://api.github.com/users/parkinsona/gists{/gist_id}","starred_url":"https://api.github.com/users/parkinsona/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/parkinsona/subscriptions","organizations_url":"https://api.github.com/users/parkinsona/orgs","repos_url":"https://api.github.com/users/parkinsona/repos","events_url":"https://api.github.com/users/parkinsona/events{/privacy}","received_events_url":"https://api.github.com/users/parkinsona/received_events","type":"User","site_admin":false},"created_at":"2015-02-03T22:01:04Z","updated_at":"2015-02-03T22:01:04Z","body":"Thanks for updating it to a warning :) \r\n\r\nDoes the post logout uri belong to the user or to the RP?\r\n\r\nIf the user isn't authenticated, and you show the logout URI, what vulnerability is there? If they're redirected back to an RP, then that RP won't consider them logged in so I wouldn't think it would be a problem."}}