# Azure AD + Pomerium logout issue — local session clears but Pomerium cookie remains valid
**URL:** https://discuss.pomerium.com/t/azure-ad-pomerium-logout-issue-local-session-clears-but-pomerium-cookie-remains-valid/493
**Category:** Support
**Created:** [August 18, 2025, 2:05pm UTC](https://discuss.pomerium.com/t/azure-ad-pomerium-logout-issue-local-session-clears-but-pomerium-cookie-remains-valid/493 "2025-08-18T14:05:54Z")
**Posts on this page:** 2
**Page:** 1
### Author:  [@prtkkmrsngh](https://discuss.pomerium.com/u/prtkkmrsngh)
#### Post date: [August 18, 2025, 2:05pm UTC](https://discuss.pomerium.com/t/azure-ad-pomerium-logout-issue-local-session-clears-but-pomerium-cookie-remains-valid/493/1 "2025-08-18T14:05:54Z")
## What happened?
We have a web application using Node.js (backend) and React (frontend), and handling authentication via Azure AD and Pomerium (acting as reverse proxy + auth middleware).
🔐 Auth Flow Setup:
- Frontend uses React and calls backend APIs.
- Azure AD handles authentication.
- Pomerium is integrated to enforce auth via Azure AD and manage sessions.
- After successful login, Pomerium sets authentication cookies.
❌ Problem:
When a user logs out, we:
- Clear the local session/token in our React/Node app.
- Redirect to /.pomerium/sign\_out
However, the Pomerium authentication cookies remain valid, meaning:
- The user can still access APIs directly (via curl/postman) if they reuse the Pomerium cookie.
We tried triggering the frontchannel logout via:
```auto
https:///.pomerium/sign_out
```
But it fails with an “invalid CSRF token” error, and the cookie persists.
✅ What we’ve tried:
- Manually clearing localStorage/sessionStorage in React.
- Sending a GET/POST to Pomerium logout endpoint.
- Trying to include CSRF tokens (but not sure how to get them securely).
## What did you expect to happen?
On logout Pomerium token cookies should be invalidated
## What’s your environment like?
- Pomerium version (retrieve with `pomerium --version`): v0.16.4
- Server Operating System/Architecture/Cloud: Azure
🤔 Questions:
- How can we completely log out a user, including clearing Pomerium cookies?
- What is the correct flow to call Pomerium’s logout endpoint? Do we need to include CSRF tokens from somewhere?
- Is there a recommended way to trigger logout across Azure AD, our app, and Pomerium to ensure sessions are invalidated across the board?
Any insights or working examples would be appreciated!
---
### Author:  [@anon77921604](https://discuss.pomerium.com/u/anon77921604)
#### Post date: [September 9, 2025, 2:10pm UTC](https://discuss.pomerium.com/t/azure-ad-pomerium-logout-issue-local-session-clears-but-pomerium-cookie-remains-valid/493/2 "2025-09-09T14:10:53Z")
Hi there,
Thank you for using Pomerium!
The /.pomerium/sign\_out url is the correct url for triggering front channel logout and clearing session cookies. [Special Routes | Pomerium](https://docs.pomerium.com/docs/internals/special-routes#single-sign-out-endpoint)
It looks like you using v0.16.4, which was released over three years ago. Since then, there have been significant changes and improvements to Pomerium, which make it difficult for us to confirm if the issue you are experiencing has been addressed over the years.
Please upgrade to our latest version, v0.30.6, and confirm if you are still experiencing the issue.