VerifiedLogoutToken
in package
What a verified back-channel logout token names (CONTRACT.md §12.7.3).
Deliberately not a bare bool: the RP has to know which session to end, and a
verifier that only says "valid" would force the caller to re-parse the token
themselves, with none of the checks this type is proof of.
Table of Contents
Properties
Methods
- __construct() : mixed
Properties
$jti read-only
public
string
$jti
$sid read-only
public
string|null
$sid
$sub read-only
public
string|null
$sub
Methods
__construct()
public
__construct(string|null $sid, string|null $sub, string $jti) : mixed
Parameters
- $sid : string|null
-
The session that ended. When non-
null, end only this session — falling back to "every session for$sub" is over-reach the AXIAM server itself refuses to make. - $sub : string|null
-
The subject whose session ended.
- $jti : string
-
Replay identifier. The RP dedups on this, not the SDK. Back-channel delivery is at-least-once with retry, so a valid token legitimately arrives twice; the SDK has no durable store and an in-memory guard would silently drop a real second logout after a restart. Surfaced, never consumed.