Added OAUTH_LOGOUT_URI environment variable (PersistentConfig) to allow configuring a custom logout URL for SSO providers
When OAUTH_LOGOUT_URI is set and an OAuth session exists, the signout handler redirects to it directly, bypassing the standard OIDC end_session_endpoint discovery flow
Updated the startup warning to not fire when OAUTH_LOGOUT_URI is configured (since logout will work without OPENID_PROVIDER_URL in that case)
Motivation
SSO providers like AWS Cognito do not support the standard OIDC logout flow (end_session_endpoint with id_token_hint / post_logout_redirect_uri). They require provider-specific logout URLs with different parameters. This change allows administrators to set the full logout URI upfront, which is sufficient when all values are known at configuration time.
🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.
## 📋 Pull Request Information
**Original PR:** https://github.com/open-webui/open-webui/pull/21634
**Author:** [@hztBUAA](https://github.com/hztBUAA)
**Created:** 2/20/2026
**Status:** ❌ Closed
**Base:** `main` ← **Head:** `feat/sso-custom-logout-uri`
---
### 📝 Commits (1)
- [`9ae0e91`](https://github.com/open-webui/open-webui/commit/9ae0e917725a4e072c8579aef14217539e8c4488) feat: add OAUTH_LOGOUT_URI for custom SSO logout redirection
### 📊 Changes
**2 files changed** (+21 additions, -1 deletions)
<details>
<summary>View changed files</summary>
📝 `backend/open_webui/config.py` (+7 -1)
📝 `backend/open_webui/routers/auths.py` (+14 -0)
</details>
### 📄 Description
## Summary
Fixes #19182
- Added `OAUTH_LOGOUT_URI` environment variable (PersistentConfig) to allow configuring a custom logout URL for SSO providers
- When `OAUTH_LOGOUT_URI` is set and an OAuth session exists, the signout handler redirects to it directly, bypassing the standard OIDC `end_session_endpoint` discovery flow
- Updated the startup warning to not fire when `OAUTH_LOGOUT_URI` is configured (since logout will work without `OPENID_PROVIDER_URL` in that case)
## Motivation
SSO providers like AWS Cognito do not support the standard OIDC logout flow (`end_session_endpoint` with `id_token_hint` / `post_logout_redirect_uri`). They require provider-specific logout URLs with different parameters. This change allows administrators to set the full logout URI upfront, which is sufficient when all values are known at configuration time.
### Example usage (AWS Cognito)
```
OAUTH_LOGOUT_URI=https://<domain>.auth.<region>.amazoncognito.com/logout?client_id=<client_id>&logout_uri=https://<your-app-url>
```
## Changes
- `backend/open_webui/config.py`: Added `OAUTH_LOGOUT_URI` PersistentConfig; updated startup warning logic
- `backend/open_webui/routers/auths.py`: Imported `OAUTH_LOGOUT_URI`; added early return in signout handler when custom URI is configured
## Test plan
- [x] Verified Python syntax validity of both changed files
- [ ] Set `OAUTH_LOGOUT_URI` to a custom URL and verify signout redirects to it
- [ ] Leave `OAUTH_LOGOUT_URI` unset and verify existing OIDC logout flow still works
- [ ] Set `OAUTH_LOGOUT_URI` without `OPENID_PROVIDER_URL` and verify no startup warning
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---
<sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
📋 Pull Request Information
Original PR: https://github.com/open-webui/open-webui/pull/21634
Author: @hztBUAA
Created: 2/20/2026
Status: ❌ Closed
Base:
main← Head:feat/sso-custom-logout-uri📝 Commits (1)
9ae0e91feat: add OAUTH_LOGOUT_URI for custom SSO logout redirection📊 Changes
2 files changed (+21 additions, -1 deletions)
View changed files
📝
backend/open_webui/config.py(+7 -1)📝
backend/open_webui/routers/auths.py(+14 -0)📄 Description
Summary
Fixes #19182
OAUTH_LOGOUT_URIenvironment variable (PersistentConfig) to allow configuring a custom logout URL for SSO providersOAUTH_LOGOUT_URIis set and an OAuth session exists, the signout handler redirects to it directly, bypassing the standard OIDCend_session_endpointdiscovery flowOAUTH_LOGOUT_URIis configured (since logout will work withoutOPENID_PROVIDER_URLin that case)Motivation
SSO providers like AWS Cognito do not support the standard OIDC logout flow (
end_session_endpointwithid_token_hint/post_logout_redirect_uri). They require provider-specific logout URLs with different parameters. This change allows administrators to set the full logout URI upfront, which is sufficient when all values are known at configuration time.Example usage (AWS Cognito)
Changes
backend/open_webui/config.py: AddedOAUTH_LOGOUT_URIPersistentConfig; updated startup warning logicbackend/open_webui/routers/auths.py: ImportedOAUTH_LOGOUT_URI; added early return in signout handler when custom URI is configuredTest plan
OAUTH_LOGOUT_URIto a custom URL and verify signout redirects to itOAUTH_LOGOUT_URIunset and verify existing OIDC logout flow still worksOAUTH_LOGOUT_URIwithoutOPENID_PROVIDER_URLand verify no startup warning🤖 Generated with Claude Code
🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.