diff --git a/IdentityServer/v5/docs/content/ui/logout/session_cleanup.md b/IdentityServer/v5/docs/content/ui/logout/session_cleanup.md index 59cee88e..3f372e9f 100644 --- a/IdentityServer/v5/docs/content/ui/logout/session_cleanup.md +++ b/IdentityServer/v5/docs/content/ui/logout/session_cleanup.md @@ -22,9 +22,9 @@ Typically you should prompt the user to logout which requires a POST to remove t Otherwise an attacker could hotlink to your logout page causing the user to be automatically logged out. This means you will need a page to prompt the user to logout. -If a *logoutId* is passed to the login page and the returned *LogoutRequest*'s *ShowSignoutPrompt* is *false* then it is safe to skip the prompt. +If a *logoutId* is passed to the logout page and the returned *LogoutRequest*'s *ShowSignoutPrompt* is *false* then it is safe to skip the prompt. This would occur when the logout page is requested due to a validated client initiated logout via the [end session endpoint]({{}}). -Your logout page process can continue as if they user submitted the post back to logout, in essence calling *SignOutAsync*. +Your logout page process can continue as if the user submitted the post back to logout, in essence calling *SignOutAsync*. ### External Logins diff --git a/IdentityServer/v6/docs/content/ui/logout/session_cleanup.md b/IdentityServer/v6/docs/content/ui/logout/session_cleanup.md index a0f2da69..ef64d4e8 100644 --- a/IdentityServer/v6/docs/content/ui/logout/session_cleanup.md +++ b/IdentityServer/v6/docs/content/ui/logout/session_cleanup.md @@ -26,7 +26,7 @@ Typically you should prompt the user to logout which requires a POST to remove t Otherwise an attacker could hotlink to your logout page causing the user to be automatically logged out. This means you will need a page to prompt the user to logout. -If a *logoutId* is passed to the login page and the returned *LogoutRequest*'s *ShowSignoutPrompt* is *false* then it is safe to skip the prompt. +If a *logoutId* is passed to the logout page and the returned *LogoutRequest*'s *ShowSignoutPrompt* is *false* then it is safe to skip the prompt. This would occur when the logout page is requested due to a validated client initiated logout via the [end session endpoint]({{}}). Your logout page process can continue as if the user submitted the post back to logout, in essence calling *SignOutAsync*. diff --git a/IdentityServer/v7/docs/content/ui/logout/session_cleanup.md b/IdentityServer/v7/docs/content/ui/logout/session_cleanup.md index 8c9f864e..fe070dbb 100644 --- a/IdentityServer/v7/docs/content/ui/logout/session_cleanup.md +++ b/IdentityServer/v7/docs/content/ui/logout/session_cleanup.md @@ -26,7 +26,7 @@ Typically you should prompt the user to logout which requires a POST to remove t Otherwise an attacker could hotlink to your logout page causing the user to be automatically logged out. This means you will need a page to prompt the user to logout. -If a *logoutId* is passed to the login page and the returned *LogoutRequest*'s *ShowSignoutPrompt* is *false* then it is safe to skip the prompt. +If a *logoutId* is passed to the logout page and the returned *LogoutRequest*'s *ShowSignoutPrompt* is *false* then it is safe to skip the prompt. This would occur when the logout page is requested due to a validated client initiated logout via the [end session endpoint]({{}}). Your logout page process can continue as if the user submitted the post back to logout, in essence calling *SignOutAsync*.