# Logout done right
## The two sessions
- Your app session (cookie, local storage).
- The Auth0 session (cookie on your tenant domain, the SSO cookie).
Clearing only the app session means the next `loginWithRedirect` returns instantly as the same user. Users experience this as "logout does not work".
## SDK logout
```
await logout({ logoutParams: { returnTo: window.location.origin } });
```
The SDK clears its local state and redirects to the tenant's /v2/logout endpoint with returnTo and client_id as query params. Auth0 clears its session and returns to returnTo.
## Allowed Logout URLs
`returnTo` must be registered under Allowed Logout URLs, exact match. Unregistered returnTo values are ignored and the user lands on a generic page (or the request is rejected). Register every post-logout landing page.
## Federated logout
If users logged in via an enterprise connection or social IdP, add `federated=true` to also log them out at the upstream IdP. Without it, the IdP session survives and the next login re-authenticates without a password. Only use it when the product wants true upstream logout; it can surprise users who share the IdP session with other apps.
## Regular web apps
express-openid-connect with `auth0Logout: true` handles the /v2/logout redirect. Django/Flask: redirect manually as in the framework skills, and clear the server session first.
## Checklist
- Logout clears app state, hits /v2/logout, and returnTo is allowlisted.
- Test in a fresh profile: login, logout, then visit /login and confirm you see the login page, not an instant redirect back in.