{"record":{"id":"729c66e127dc1dc3","repo":"apereo/cas","slug":"no-successful-logout-response-received-from-the","errorCode":null,"errorMessage":"No (successful) logout response received from the url [{}]","messagePattern":"No \\(successful\\) logout response received from the url \\[(.+?)\\]","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"support/cas-server-support-oidc-core-api/src/main/java/org/apereo/cas/oidc/slo/OidcSingleLogoutServiceMessageHandler.java","lineNumber":116,"sourceCode":"        val payload = logoutMessage.getPayload();\n        HttpResponse response = null;\n        try {\n            val exec = HttpExecutionRequest.builder()\n                .method(HttpMethod.POST)\n                .url(msg.getUrl().toExternalForm())\n                .entity(\"logout_token=\" + payload)\n                .headers(CollectionUtils.wrap(HttpHeaders.CONTENT_TYPE, msg.getContentType()))\n                .httpClient(getHttpClient())\n                .build();\n            response = HttpUtils.execute(exec);\n            if (response != null && !Objects.requireNonNull(HttpStatus.resolve(response.getCode())).isError()) {\n                LOGGER.trace(\"Received logout response [{}]\", response.getCode());\n                return true;\n            }\n        } finally {\n            HttpUtils.close(response);\n        }\n        LOGGER.warn(\"No (successful) logout response received from the url [{}]\", msg.getUrl().toExternalForm());\n        return false;\n    }\n}\n","sourceCodeStart":98,"sourceCodeEnd":120,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/support/cas-server-support-oidc-core-api/src/main/java/org/apereo/cas/oidc/slo/OidcSingleLogoutServiceMessageHandler.java#L98-L120","documentation":"During OpenID Connect single logout, CAS notifies each registered relying party's logout URL with an HTTP request. This warning is logged when the HTTP call completes without receiving a successful (2xx) logout response from the endpoint, and the affected service is skipped (the method returns false). It means the relying party did not confirm the logout request.","triggerScenarios":"sendMessageToEndpoint posts the logout message to the registered service's logout URL via HttpUtils; the response code is not 2xx, the connection fails before a response arrives, or the response object is unusable before the success check.","commonSituations":"Relying party logout endpoint down or behind a firewall/proxy rejecting CAS traffic; logout URL in the OIDC service definition is wrong or uses https with an untrusted certificate; RP rejects the logout payload and returns 4xx; DNS/network issues from the CAS server host or container.","solutions":["Verify the service's logout URL is correct and reachable from the CAS server (curl the URL from the CAS host).","Check CAS logs for the underlying HTTP exception/stack trace to distinguish connection failure from an HTTP error status.","Confirm the RP logout endpoint accepts the CAS SLO message format and returns a 2xx response.","If the RP certificate is self-signed, import it into the CAS trust store or fix TLS configuration.","Re-test logout for that specific registered service; the failure only skips one RP, others still receive logout notifications."],"exampleFix":"// before (service definition JSON)\n\"logoutUrl\": \"https://rp.example.com/old-logout-path\"\n// after\n\"logoutUrl\": \"https://rp.example.com/cas-oidc/logout\"","handlingStrategy":"validation","validationCode":"// Verify the logout endpoint from the CAS host before registering the service:\nboolean isLogoutUrlReachable(String url) throws Exception {\n    HttpURLConnection c = (HttpURLConnection) new URL(url).openConnection();\n    c.setConnectTimeout(5000);\n    c.setRequestMethod(\"POST\");\n    int code = c.getResponseCode();\n    return code >= 200 && code < 300;\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Validate the logout URL with a curl/HEAD check from the CAS server before saving the service definition.","Ensure TLS certificates of all relying parties are trusted by the CAS JVM trust store.","Monitor CAS logs for this warning per service to catch RPs whose endpoints silently fail.","Keep RP logout endpoints reachable from the CAS network zone (firewall/proxy rules)."],"tags":["http","logout","oidc","network"],"backgroundTag":"http-request-failed","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}