OIDC backchannel logout from mobile app

[MicDG]

I have searched the existing issues, both open and closed, to make sure this is not a duplicate report.

• Yes

The bug

Environment

• iOS: 18.7
• Identity provider: Authentik 2026.8.3
• Reverse proxy: Caddy

Behavior

Browser logout ends the Authentik session with the provider's invalidation flow configured appropriately. Logging back in asks for credentials again.

In the iOS app, logout ends the Immich session, but the next OAuth login signs in automatically using the existing Authentik session.

Evidence

During iOS logout, Caddy logs show a request to Authentik's OIDC discovery endpoint (shown in the attached logs) but no request to:
/application/o/immich/end-session/

The mobile AuthService.logout() implementation calls the logout API and clears local data, but does not appear to follow the returned OIDC logout URL:
https://github.com/immich-app/immich/blob/v3.3.1/mobile/lib/services/auth.service.dart#L84

Is provider logout intentionally unsupported on mobile?
Could mobile logout optionally end the identity-provider session?

The OS that Immich Server is running on

Debian GNU/Linux 13.7 (trixie)

Version of Immich Server

v3.3.1

Version of Immich Mobile App

v3.3.1

Platform with the issue

• Server
• Web
• Mobile

Device make and model

Apple iPhone 11

Your docker-compose.yml content

#
# WARNING: To install Immich, follow our guide: https://docs.immich.app/install/docker-compose
#
# Make sure to use the docker-compose.yml of the current release:
#
# https://github.com/immich-app/immich/releases/latest/download/docker-compose.yml
#
# The compose file on main may not be compatible with the latest release.

name: immich

services:
  immich-server:
    container_name: immich_server
    image: ghcr.io/immich-app/immich-server:${IMMICH_VERSION:-release}
    # extends:
    #   file: hwaccel.transcoding.yml
    #   service: cpu # set to one of [nvenc, quicksync, rkmpp, vaapi, vaapi-wsl] for accelerated transcoding
    volumes:
      # Do not edit the next line. If you want to change the media storage location on your system, edit the value of UPLOAD_LOCATION in the .env file
      - ${UPLOAD_LOCATION}:/data
      - /etc/localtime:/etc/localtime:ro
    env_file:
      - .env
    user: '1002:1002'
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - NET_RAW
    ports:
      - '127.0.0.1:2283:2283'
    depends_on:
      - redis
      - database
    restart: always
    healthcheck:
      disable: false

  immich-machine-learning:
    container_name: immich_machine_learning
    # For hardware acceleration, add one of -[armnn, cuda, rocm, openvino, rknn] to the image tag.
    # Example tag: ${IMMICH_VERSION:-release}-cuda
    image: ghcr.io/immich-app/immich-machine-learning:${IMMICH_VERSION:-release}
    # extends: # uncomment this section for hardware acceleration - see https://docs.immich.app/features/ml-hardware-acceleration
    #   file: hwaccel.ml.yml
    #   service: cpu # set to one of [armnn, cuda, rocm, openvino, openvino-wsl, rknn] for accelerated inference - use the `-wsl` version for WSL2 where applicable
    volumes:
      - ./ml-model-cache:/cache
      - ./ml-dotcache:/.cache
      - ./ml-config:/.config
    env_file:
      - .env
    user: '1002:1002'
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - NET_RAW
    restart: always
    healthcheck:
      disable: false

  redis:
    container_name: immich_redis
    image: docker.io/valkey/valkey:9@sha256:3eeb09785cd61ec8e3be35f8804c8892080f3ca21934d628abc24ee4ed1698f6
    user: '1002:1002'
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - NET_RAW
    volumes:
      - ./redis:/data
    healthcheck:
      test: redis-cli ping || exit 1
    restart: always

  database:
    container_name: immich_postgres
    image: ghcr.io/immich-app/postgres:14-vectorchord0.4.3-pgvectors0.2.0@sha256:bcf63357191b76a916ae5eb93464d65c07511da41e3bf7a8416db519b40b1c23
    environment:
      POSTGRES_PASSWORD: ${DB_PASSWORD}
      POSTGRES_USER: ${DB_USERNAME}
      POSTGRES_DB: ${DB_DATABASE_NAME}
      POSTGRES_INITDB_ARGS: '--data-checksums'
      # Uncomment the DB_STORAGE_TYPE: 'HDD' var if your database isn't stored on SSDs
      # DB_STORAGE_TYPE: 'HDD'
    volumes:
      # Do not edit the next line. If you want to change the database storage location on your system, edit the value of DB_DATA_LOCATION in the .env file
      - ${DB_DATA_LOCATION}:/var/lib/postgresql/data
#    user: '1002:1002'
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - NET_RAW
    shm_size: 128mb
    restart: always
    healthcheck:
      disable: false

#volumes:
#  model-cache:

Your .env content

# You can find documentation for all the supported env variables at https://docs.immich.app/install/environment-variables

# Disable admin signup
IMMICH_ALLOW_SETUP=false

# Trusted Proxies (Caddy LAN)
IMMICH_TRUSTED_PROXIES=192.168.x.x

# Listen only to localhost
#IMMICH_HOST=127.0.0.1

# The location where your uploaded files are stored
UPLOAD_LOCATION=./library

# The location where your database files are stored. Network shares are not supported for the database
DB_DATA_LOCATION=./postgres

# To set a timezone, uncomment the next line and change Etc/UTC to a TZ identifier from this list: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones#List
TZ=Europe/Rome

# The Immich version to use. You can pin this to a specific version like "v2.1.0"
IMMICH_VERSION=v3

# Connection secret for postgres. You should change it to a random password
# Please use only the characters `A-Za-z0-9`, without special characters or spaces
DB_PASSWORD=redacted

# The values below this line do not need to be changed
###################################################################################
DB_USERNAME=postgres
DB_DATABASE_NAME=immich

Reproduction steps

1. Sign in to Immich iOS through Authentik.
2. Sign out of Immich.
3. Select OAuth login again.
4. Login completes without asking for credentials.

Relevant log output

{"level":"info","ts":1791976215.647492,"logger":"http.log.access","msg":"handled request","request":{"remote_ip":"(redacted)","remote_port":"(redacted)","client_ip":"(redacted)","proto":"HTTP/1.1","method":"GET","host":"auth.example.com","uri":"/application/o/immich/.well-known/openid-configuration","headers":{"Accept":["application/json"],"User-Agent":["openid-client/v6.8.8"],"Accept-Language":["*"],"Sec-Fetch-Mode":["cors"],"Accept-Encoding":["br, gzip, deflate"],"Connection":["keep-alive"]},"tls":{"resumed":false,"version":772,"cipher_suite":4865,"proto":"http/1.1","server_name":"auth.example.com","ech":false}},"bytes_read":0,"user_id":"","duration":0.179540213,"size":2227,"status":200,"resp_headers":{"Vary":["Accept-Language, Cookie"],"Content-Type":["application/json"],"X-Frame-Options":["DENY"],"X-Content-Type-Options":["nosniff"],"Date":["Wed, 14 Oct 2026 11:10:14 GMT"],"Via":["1.1 Caddy"],"Alt-Svc":["h3=\":443\"; ma=2592000"],"Server":["uvicorn"],"Referrer-Policy":["same-origin"],"Content-Language":["en"],"X-Powered-By":["authentik"],"Content-Length":["2227"],"X-Authentik-Id":["(redacted)"]}}

Additional information

No response