{"record":{"id":"916041a652bf2e79","repo":"open-webui/open-webui","slug":"failed-to-sign-out-from-the-openid-provider","errorCode":null,"errorMessage":"Failed to sign out from the OpenID provider.","messagePattern":"Failed to sign out from the OpenID provider\\.","errorType":"http","errorClass":"HTTPException","httpStatus":500,"severity":"error","filePath":"backend/open_webui/routers/auths.py","lineNumber":1023,"sourceCode":"                                return JSONResponse(\n                                    status_code=200,\n                                    content={\n                                        'status': True,\n                                        'redirect_url': f'{logout_url}?id_token_hint={oauth_id_token}'\n                                        + (\n                                            f'&post_logout_redirect_uri={WEBUI_AUTH_SIGNOUT_REDIRECT_URL}'\n                                            if WEBUI_AUTH_SIGNOUT_REDIRECT_URL\n                                            else ''\n                                        ),\n                                    },\n                                    headers=response.headers,\n                                )\n                        else:\n                            raise Exception('Failed to fetch OpenID configuration')\n\n            except Exception as e:\n                log.error(f'OpenID signout error: {str(e)}')\n                raise HTTPException(\n                    status_code=500,\n                    detail='Failed to sign out from the OpenID provider.',\n                    headers=response.headers,\n                )\n\n    if WEBUI_AUTH_SIGNOUT_REDIRECT_URL:\n        return JSONResponse(\n            status_code=200,\n            content={\n                'status': True,\n                'redirect_url': WEBUI_AUTH_SIGNOUT_REDIRECT_URL,\n            },\n            headers=response.headers,\n        )\n\n    return JSONResponse(status_code=200, content={'status': True}, headers=response.headers)\n\n","sourceCodeStart":1005,"sourceCodeEnd":1041,"githubUrl":"https://github.com/open-webui/open-webui/blob/01f4282f1ffe0d6212f58d3afbeae21fffd0c4be/backend/open_webui/routers/auths.py#L1005-L1041","documentation":"A 500 from the signout endpoint when tearing down the OpenID session fails: the server fetches the provider's .well-known/openid-configuration to build the end_session_endpoint redirect, and any exception (failed fetch, missing config) is caught, logged as 'OpenID signout error', and re-raised as this HTTPException. It carries response.headers so cookies already cleared are still applied.","triggerScenarios":"GET/POST /api/v1/auths/signout with an OAuth/OIDC provider configured while the provider's discovery URL is unreachable, returns invalid JSON, or lacks end_session_endpoint; DNS failure; provider downtime; self-hosted provider with wrong issuer URL.","commonSituations":"Keycloak/Auth0 instance stopped or moved; firewall blocks the backend's egress to the IdP; issuer URL changed after a provider migration; TLS certificate of the IdP expired.","solutions":["Check the server log for 'OpenID signout error: ...' to see the underlying request failure.","Verify the OIDC provider is up and its discovery URL (issuer + /.well-known/openid-configuration) resolves from the backend host.","Confirm the configured OAuth provider issuer/client settings in Admin Panel > Settings > OAuth.","As a workaround, sign out locally by clearing the auth cookie; the local session is already invalidated even though the provider redirect failed."],"exampleFix":null,"handlingStrategy":"fallback","validationCode":"// Before signout redirect, verify the provider discovery doc is reachable\ntry { await fetch(`${oidcIssuer}/.well-known/openid-configuration`, { signal: AbortSignal.timeout(3000) }); } catch { useLocalSignoutOnly(); }","typeGuard":null,"tryCatchPattern":"try { await api.get('/api/v1/auths/signout'); } catch (e) { if (/OpenID/i.test(e.response?.data?.detail)) { clearLocalSession(); window.location = '/'; } else throw e; }","preventionTips":["Monitor IdP availability from the backend network","Fall back to local signout (clear cookie, redirect home) when provider signout fails","Keep the issuer URL current after provider migrations"],"tags":["auth","openid-connect","signout","network","http-500"],"backgroundTag":null,"analyzedSha":"01f4282f1ffe0d6212f58d3afbeae21fffd0c4be","analyzedAt":"2026-08-14T18:25:22.715Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}