OIDC /api/logout expires access_token but does not delete casdoor_session_id

Hi, I’m testing the OIDC logout flow using the /api/logout endpoint by sending an id_token_hint. I noticed that while this call expires the access_token , the corresponding casdoor_session_id record under Sessions in Casdoor is not deleted.

Looking at the code, I found that session deletion uses Beego’s context (c.Ctx.Input.CruSession.SessionID()),:

owner, username := util.GetOwnerAndNameFromId(user)
_, err = object.DeleteSessionId(util.GetSessionId(owner, username, object.CasdoorApplication), c.Ctx.Input.CruSession.SessionID())
if err != nil {
    c.ResponseError(err.Error())
    return
}

Is this the expected behavior for /api/logout?
If so, what’s the recommended way to delete a specific casdoor_session_id entry in Casdoor when logging out through this endpoint?

@zxnitsu. what is casdoor_session_id? can you give an example of casdoor_session_id?

Hi @hsluoyz , the Session IDs that casdoor issues and maintains for a login

why do you want to delete that? If you forget the cookie, that session is just becoming invalid