How can I securely log out from AWS Cognito Hosted UI in a SPA without CORS errors?

Question

I'm building a SPA/PWA (React + Vite) that uses AWS Cognito Hosted UI as the OIDC provider. The login and token refresh flows work perfectly but only with the cognito-idp.* URI (not recommended by the documentation). However, I'm running into an issue with the logout process.

Whenever I try to log out by making an AJAX call (via `fetch` or `axios`) to the Cognito `/logout` endpoint, the browser blocks the request with a CORS error. This is because the `/logout` endpoint - served via CloudFront - does not support preflight (`OPTIONS`) requests and does not include `Access-Control-Allow-Origin` headers. As far as I can tell, there is no way to configure CORS headers for this managed endpoint.

I understand that a common workaround is to use a window redirect to the logout endpoint, but this feels less “SPA-like,” especially when compared to token revocation via XHR - and also is not working for me, I can't logout.

Questions:

* Is there a standard or recommended way to securely log out from Cognito Hosted UI in a SPA without resorting to window redirects, and without hitting CORS errors?
* Has anyone found an official or robust workaround to allow XHR-based logouts or token revocation from the frontend, given that the Hosted UI is managed and on a separate domain?
* How are other teams handling logout and Cognito session cleanup in this scenario, especially when using Cognito as an OIDC IdP for SPAs on separate domains?

Thanks in advance for any insights or best practices!

re:Post Agent · Accepted Answer

To securely log out from AWS Cognito Hosted UI in a SPA without CORS errors, you need to understand that the Cognito `/logout` endpoint is designed as a redirection endpoint, not an API endpoint for AJAX calls.

The recommended approach for logging out users from Cognito in a SPA is:

1. Use a window redirect to the Cognito `/logout` endpoint. This is the standard approach because:
- The logout endpoint is specifically designed to work with redirects
- It properly invalidates tokens on the server-side
- It clears session cookies

For example:
```javascript
window.location.href = "https://mydomain.auth.us-east-1.amazoncognito.com/logout?client_id=your_client_id&logout_uri=https://your-app.com/logout-page";
```

The `logout_uri` parameter should point to a page in your application that's configured as an authorized sign-out URL in your Cognito app client settings.

On your logout page, you should:
- Clear any local storage or state containing user information
- Reset any application cookies to expired timestamps
- Handle the UI transition to a logged-out state

For client logout landing pages, it's important to note that they must be unauthenticated. This means they cannot be behind an Application Load Balancer rule that requires authentication.

AJAX/XHR calls to the `/logout` endpoint aren't supported because:
1. The endpoint doesn't support CORS for cross-domain requests
2. The endpoint is designed for browser redirects to properly clear session state
3. The logout process involves multiple redirects that can't be properly handled via AJAX

If you're experiencing issues with the window redirect approach, ensure that:
- Your `logout_uri` is properly URL-encoded
- The URI is registered as an allowed sign-out URL in your Cognito app client settings
- You're including the required `client_id` parameter

This redirect-based approach is the standard pattern for OIDC providers, not just Cognito, and is the most secure way to handle logout in SPAs using external authentication providers.  
**Sources**  
[How to logout from ALB-Cognito which is EC2 instance running React | AWS re:Post](https://repost.aws/questions/QUYmG0ZU6uTLOaE7p22zPGaw/how-to-logout-from-alb-cognito-which-is-ec2-instance-running-react)  
[The managed login sign-out endpoint: /logout - Amazon Cognito](https://docs.aws.amazon.com/cognito/latest/developerguide/logout-endpoint.html)  
[Authenticate users using an Application Load Balancer - Elastic Load Balancing](https://docs.aws.amazon.com/elasticloadbalancing/latest/application/listener-authenticate-users.html)

How can I securely log out from AWS Cognito Hosted UI in a SPA without CORS errors?

Add your answer

Relevant content