# Can't logout from Okta App (Express, passport-oidc)

**URL:** <https://devforum.okta.com/t/cant-logout-from-okta-app-express-passport-oidc/10519>\
**Category:** OAuth/OIDC\
**Created:** [August 14, 2020, 12:33pm UTC](https://devforum.okta.com/t/cant-logout-from-okta-app-express-passport-oidc/10519 "2020-08-14T12:33:36Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![OlegKrilov](https://avatars.discourse-cdn.com/v4/letter/o/b487fb/32.png) [@OlegKrilov](https://devforum.okta.com/u/OlegKrilov)\
**Post date:** [August 14, 2020, 12:33pm UTC](https://devforum.okta.com/t/cant-logout-from-okta-app-express-passport-oidc/10519/1 "2020-08-14T12:33:36Z")

</div>

Good day.

Facing the strange issue, that I can’t resolve without help.  
Am building authorization module for some old NodeJS application. For some reasons I have to use passport & passport-openidconnect npm modules.

This is passport config, it works as expected

```
passport.use('oidc', new OidcStrategy({
    	issuer: issuer,
    	authorizationURL: AUTHORIZATION_SERVICE + '/oauth2/default/v1/authorize',
    	tokenURL: AUTHORIZATION_SERVICE + '/oauth2/default/v1/token',
    	userInfoURL: AUTHORIZATION_SERVICE + '/oauth2/default/v1/userinfo',
    	clientID: CLIENT_ID,
    	clientSecret: CLIENT_SECRET,
    	callbackURL: BASE_URL + ON_SIGN_IN,
    	appBaseUrl: BASE_URL,
    	scope: DEFAULT_SCOPE
}, (issuer, sub, profile, accessToken, refreshToken, done) => done(null, profile)));

```

Ok, login process works fine, user is stored in passport session, application works as expected.

But when am trying to logout with this express middleware  
const \_clearSession = (req, res) =\> {  
req.logout();  
req.session.destroy();  
res.redirect(LOGIN\_ROUTE);  
};  
despite the session is destroyed, user remains still logged in Okta account somehow, so instead of going to the Okta login form user immediately sees the default page as the authorized user.

Also tried to logout with /revoke enpoint:  
https://{myOktaAppUrl}/oauth2/v1/revoke  
with params token hint, token, client id, client secret.  
But it failed with error that “invalid\_client”.

Could someone help me to solve this issue?

Thanks in advance

---

<div class="post-metadata">

**Author:** ![phi1ipp](https://avatars.discourse-cdn.com/v4/letter/p/85f322/32.png) [@phi1ipp](https://devforum.okta.com/u/phi1ipp)\
**Post date:** [August 16, 2020, 12:52am UTC](https://devforum.okta.com/t/cant-logout-from-okta-app-express-passport-oidc/10519/2 "2020-08-16T00:52:06Z")

</div>

Hi Oleg,

revoke won’t be able to fix it for you, as it only revokes the token, but the problem is a user’s browser still has a session cookie with Okta, that’s why they are able to immediately pass through login process.

I’m not very familiar with passport and nodejs, but I’d recommend to use logout request instead [https://developer.okta.com/docs/reference/api/oidc/#logout](https://developer.okta.com/docs/reference/api/oidc/#logout) if you can’t make passport work for you

---

<div class="post-metadata">

**Author:** ![OlegKrilov](https://avatars.discourse-cdn.com/v4/letter/o/b487fb/32.png) [@OlegKrilov](https://devforum.okta.com/u/OlegKrilov)\
**Post date:** [August 17, 2020, 2:20pm UTC](https://devforum.okta.com/t/cant-logout-from-okta-app-express-passport-oidc/10519/3 "2020-08-17T14:20:22Z")

</div>

Thank you, [phi1ipp](https://devforum.okta.com/u/phi1ipp). Will try to implement this way.

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/oktadev/original/1X/589c4c5f80de422d01f47cee7185a7fb8227835c.png) [@system](https://devforum.okta.com/u/system)\
**Post date:** [January 24, 2024, 11:52pm UTC](https://devforum.okta.com/t/cant-logout-from-okta-app-express-passport-oidc/10519/4 "2024-01-24T23:52:40Z")

</div>

This topic was automatically closed 24 hours after the last reply. New replies are no longer allowed.