Logout should be predictable

Users expect logout to mean the session is over. In SSO integrations, Django may clear its local session while Keycloak still has an active SSO session, allowing silent re-login. That may be acceptable for some apps and unacceptable for others. The behavior must be deliberate.

Implementation decisions

Decide whether application logout should also trigger Keycloak logout. Align Django session age with Keycloak SSO idle and max session settings. For sensitive workflows, require reauthentication even when SSO remains active. Test disabled-user scenarios so access removal is not delayed by stale sessions.

Checklist

  • Clear Django session on logout.
  • Redirect to Keycloak logout when full logout is required.
  • Use HTTPS and secure cookie settings.
  • Communicate session behavior through UX, not hidden surprises.

Session clarity reduces support calls and security ambiguity.