{"action":"created","issue":{"url":"https://api.github.com/repos/IdentityServer/IdentityServer3/issues/2356","labels_url":"https://api.github.com/repos/IdentityServer/IdentityServer3/issues/2356/labels{/name}","comments_url":"https://api.github.com/repos/IdentityServer/IdentityServer3/issues/2356/comments","events_url":"https://api.github.com/repos/IdentityServer/IdentityServer3/issues/2356/events","html_url":"https://github.com/IdentityServer/IdentityServer3/issues/2356","id":124584925,"number":2356,"title":"Wrong logout redirect URI & CORS ","user":{"login":"iLearnIdentityServer","id":16447799,"avatar_url":"https://avatars.githubusercontent.com/u/16447799?v=3","gravatar_id":"","url":"https://api.github.com/users/iLearnIdentityServer","html_url":"https://github.com/iLearnIdentityServer","followers_url":"https://api.github.com/users/iLearnIdentityServer/followers","following_url":"https://api.github.com/users/iLearnIdentityServer/following{/other_user}","gists_url":"https://api.github.com/users/iLearnIdentityServer/gists{/gist_id}","starred_url":"https://api.github.com/users/iLearnIdentityServer/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/iLearnIdentityServer/subscriptions","organizations_url":"https://api.github.com/users/iLearnIdentityServer/orgs","repos_url":"https://api.github.com/users/iLearnIdentityServer/repos","events_url":"https://api.github.com/users/iLearnIdentityServer/events{/privacy}","received_events_url":"https://api.github.com/users/iLearnIdentityServer/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2016-01-02T10:55:24Z","updated_at":"2016-01-02T13:43:13Z","closed_at":null,"body":"Hi,\r\n\r\nI have some difficulties with \"endsession\" endpoint, possibly related to each other. I'm using the latest version of IdentityServer3 with custom:\r\n- UserService, CorsPolicyService, AuthorizationCodeStore, ClientStore, RefreshTokenStore, ScopeStore, TokenHandleStore\r\n\r\n1. I have problem with /connect/endsession . I did configure ClientPostLogoutRedirectURIs for client from which I'm performing logout. In the \"endsession\" request I'm passing id_token as id_token_hint and also post_logout_redirect_uri (the one registered at the IdentityServer3). But I'm get redirected to 'https://localhost:21001/logout?id=7496544db1bab1561152df038eb65a29'\r\n\r\n2. The second problem is CORS when trying to call /connect/endsession. I'm getting:\r\nIdentityServer3.Core.Configuration.Hosting.CorsPolicyProvider - CORS request made for path: /connect/endsession from origin: https://localhost:21003 but rejected because invalid CORS path\r\n\r\nWhen calling connect/authorize, I do not have this problem\r\n\r\nI have custom ICorsPolicyService, but this service never gets called. The service is registered as other services\r\nidentityServerFactory.CorsPolicyService = new Registration<ICorsPolicyService, ClientConfigurationCorsPolicyService> { Mode = RegistrationMode.InstancePerHttpRequest };\r\n\r\n3. Is it normal that in End session request have  \"SubjectId\": \"unknown\", as shown in logs?\r\n\r\nHere is the log from IdentityServer3 (please note that I replace some data in log with dots, just to make it smaller):\r\n\r\n2016-01-02 11:02:53,573 [15] WARN  IdentityServer3.Core.Configuration.Hosting.CorsPolicyProvider - CORS request made for path: /connect/endsession from origin: https://localhost:21003 but rejected because invalid CORS path\r\n2016-01-02 11:02:53,577 [15] INFO  IdentityServer3.Core.Endpoints.EndSessionController - Start end session request\r\n2016-01-02 11:02:53,578 [15] INFO  IdentityServer3.Core.Validation.EndSessionRequestValidator - Start end session request validation\r\n2016-01-02 11:02:53,578 [15] INFO  IdentityServer3.Core.Validation.TokenValidator - Start identity token validation\r\n2016-01-02 11:02:53,587 [25] INFO  IdentityServer3.Core.Validation.TokenValidator - Token validation success\r\n{\r\n  \"ClientId\": \"7b2105e4-450c-4ef5-805b-a0872ed14662\",\r\n  \"ClientName\": \"...\",\r\n  \"ValidateLifetime\": false,\r\n  \"Claims\": {\r\n    \"iss\": \"https://localhost:21001\",\r\n    \"aud\": \"7b2105e4-450c-4ef5-805b-a0872ed14662\",\r\n    \"exp\": \"1574852069\",\r\n    \"nbf\": \"1451728946\",\r\n    \"nonce\": \"14517287805170.5274384715594351\",\r\n    \"iat\": \"1451728946\",\r\n    \"at_hash\": \"gJpVyTS6frOB_pFhGicf4A\",\r\n    \"sid\": \"81028c2c74ff30158f550241ae81d95d\",\r\n    \"sub\": \"Admin\",\r\n    \"auth_time\": \"1451728946\",\r\n    \"idp\": \"idsrv\",\r\n    \"role\": [\r\n     ....\r\n    ],\r\n    \"amr\": \"password\"\r\n  }\r\n}\r\n2016-01-02 11:02:53,589 [25] INFO  IdentityServer3.Core.Validation.EndSessionRequestValidator - End session request validation success\r\n{\r\n  \"ClientId\": \"7b2105e4-450c-4ef5-805b-a0872ed14662\",\r\n  \"ClientName\": \"....\",\r\n  \"SubjectId\": \"unknown\", \r\n  \"PostLogOutUri\": \"https://localhost:21003\",\r\n  \"Raw\": {\r\n    \"id_token_hint\": \".....\",\r\n    \"post_logout_redirect_uri\": \"https://localhost:21003\"\r\n  }\r\n}\r\n2016-01-02 11:02:53,592 [25] INFO  IdentityServer3.Core.Endpoints.EndSessionController - End end session request\r\n2016-01-02 11:02:53,592 [25] INFO  IdentityServer3.Core.Results.LogoutResult - Redirecting to logout page\r\n2016-01-02 11:02:53,592 [25] DEBUG IdentityServer3.Core.Configuration.Hosting.MessageCookie`1 - Protecting message: {\"ClientId\":\"7b2105e4-450c-4ef5-805b-a0872ed14662\",\"ReturnUrl\":\"https://localhost:21003\",\"Created\":635873257735920221}\r\n\r\n\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/IdentityServer/IdentityServer3/issues/comments/168394050","html_url":"https://github.com/IdentityServer/IdentityServer3/issues/2356#issuecomment-168394050","issue_url":"https://api.github.com/repos/IdentityServer/IdentityServer3/issues/2356","id":168394050,"user":{"login":"brockallen","id":649492,"avatar_url":"https://avatars.githubusercontent.com/u/649492?v=3","gravatar_id":"","url":"https://api.github.com/users/brockallen","html_url":"https://github.com/brockallen","followers_url":"https://api.github.com/users/brockallen/followers","following_url":"https://api.github.com/users/brockallen/following{/other_user}","gists_url":"https://api.github.com/users/brockallen/gists{/gist_id}","starred_url":"https://api.github.com/users/brockallen/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/brockallen/subscriptions","organizations_url":"https://api.github.com/users/brockallen/orgs","repos_url":"https://api.github.com/users/brockallen/repos","events_url":"https://api.github.com/users/brockallen/events{/privacy}","received_events_url":"https://api.github.com/users/brockallen/received_events","type":"User","site_admin":false},"created_at":"2016-01-02T13:43:13Z","updated_at":"2016-01-02T13:43:13Z","body":"Sounds like you're trying to make an ajax call to the end session endpoint -- it's not design to be used that way. You need to navigate the user to that endpoint."}}