Repository navigation
bug: openid-connect plugin does not refresh access token when end server responds with 401 #13750
Description
Current Behavior
I understand that the openid-connect plugin does not have support for back-channel logout... our service behind the plugin does support this and knows when a user logs out or token is revoked.
Right now we have requests going through a route configured with the plugin. Authentication happens normally, the user is redirected to the IDP and then the session is created with a cookie and everything works.
The problem is after the user logs out by other means. Our backend server gets notified of the logout and considers the users access token invalid.
When a request happens again through the route with the plugin, we return a 401 from the backend server and the 401 is returned through the route instead of the openid-connect plugin trying to acquire a new token.
This is noticeable when the user logs back in, the route is broken for them until the access token it had eventually expires.
Or when the user logs in as someone else, the same thing happens.
Expected Behavior
We expect the openid-connect plugin to try to get a new access token if the token it has results in a 401 where it is being used.
Error Logs
No response
Steps to Reproduce
- configure route with openid-connect plugin
- log in user with credentials through route
- invalidate the token through other means (re-log in, or log in as new user)
- try to access through route again
Environment
apisix version 3.17.0
Metadata
Metadata
Assignees
Labels
Type
Projects
- Status
Activity
Baoyuantop commentedon Nov 2, 2026
I'm taking over the follow-up on this issue. The planned approach is to invalidate the gateway's Cookie session when it receives an OIDC back-channel logout notification from the identity provider.
The next steps are:
This plan addresses IdP-driven session invalidation. Automatically refreshing a token or retrying a request after an arbitrary upstream
401is outside this change.You mentioned that your backend already receives logout notifications. Could you confirm which IdP you use and whether the logout/revocation operations described here can also send a standard OIDC back-channel logout notification to the APISIX client? That will help verify that this approach covers your scenario.
There is no target release or ETA yet; that depends on upstream review and completion of the integration.
hcldan commentedon Nov 2, 2026
We use HCL Domino's OIDC IDP. It is capable of sending standard back-channel logout notifications to clients registered with the provider. We do this today for other services that support this.