paskia/fastapi/oid.py

@@ -466,22 +466,19 @@ async def userinfo(
 @app.post("/backchannel-logout")
 async def backchannel_logout(
     request: Request,
-    logout_token: str | None = Body(None, embed=False),
+    logout_token: str = Form(...),
 ):
     """OIDC Back-Channel Logout endpoint.
 
     Receives a logout_token JWT from the RP and invalidates the session.
     The logout_token must contain either 'sid' (session ID) or 'sub' (user ID).
+    Per OIDC Back-Channel Logout 1.0: uses application/x-www-form-urlencoded.
     """
-    # Parse form data
+    # Validate content type
     content_type = request.headers.get("content-type", "")
-    if "application/x-www-form-urlencoded" in content_type:
-        form = await request.form()
-        logout_token = form.get("logout_token", logout_token)
-
-    if not logout_token:
+    if "application/x-www-form-urlencoded" not in content_type:
         return JSONResponse(
-            {"error": "invalid_request", "error_description": "Missing logout_token"},
+            {"error": "invalid_request", "error_description": "Content-Type must be application/x-www-form-urlencoded"},
             status_code=400,
         )