# Second login required when trying to sign\_out an active session

**URL:** <https://discuss.pomerium.com/t/second-login-required-when-trying-to-sign-out-an-active-session/135>\
**Category:** Support\
**Created:** [July 7, 2022, 7:26am UTC](https://discuss.pomerium.com/t/second-login-required-when-trying-to-sign-out-an-active-session/135 "2022-07-07T07:26:48Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![svKr](https://avatars.discourse-cdn.com/v4/letter/s/7ba0ec/32.png) [@svKr](https://discuss.pomerium.com/u/svKr)\
**Post date:** [July 7, 2022, 7:26am UTC](https://discuss.pomerium.com/t/second-login-required-when-trying-to-sign-out-an-active-session/135/1 "2022-07-07T07:26:48Z")

</div>

## What happened?

There is a second login required when calling the sign\_out url on an active session.

## What did you expect to happen?

Being able to sign out of an active session without having to log in for a second time.

## How’d it happen?

My authenticate\_service\_url is “[https://auth.eu.mydomain.com](https://auth.eu.mydomain.com)”.  
I’m publishing a Web-App on “[https://myapp.eu.mydomain.com](https://myapp.eu.mydomain.com)”.  
cookie\_domain is set to “.eu.mydomain.com”.Now if i log in to [https://myapp.eu.mydomain.com](https://myapp.eu.mydomain.com)", the session is created correctly. However calling the frontchannel sign out url at “[https://auth.eu.mydomain.com/.pomerium/sign\_out](https://auth.eu.mydomain.com/.pomerium/sign_out)” requires my to log in via Google again before being able to log out.  
Once i’ve logged in for the second time and confirm the logout prompt, all cookies are terminated correctly and i’m signed out for both “[https://auth.eu.mydomain.com/](https://auth.eu.mydomain.com/)” and “[https://myapp.eu.mydomain.com/](https://myapp.eu.mydomain.com/)”.  
Is there a way to avoid the second login prior to being able to logout?

## What’s your environment like?

- Docker pomerium/pomerium:v0.17.3
- Ubuntu Host

## What’s your config.yaml?

```auto
config.yaml

# See detailed configuration settings : https://www.pomerium.io/docs/reference/reference/

# this is the domain the identity provider will callback after a user authenticates
authenticate_service_url: https://auth.eu.mydomain.com
authorize_service_url: http://127.0.0.1:5443
default_upstream_timeout: 4000s
timeout_read: 1800s
timeout: 600s
idle_timeout: 4000s

headers:
  Cache-Control: no-cache

IDP_PROVIDER: google
IDP_PROVIDER_URL: https://accounts.google.com
IDP_CLIENT_ID: aaaaaaaaaaaaaa.apps.googleusercontent.com
IDP_CLIENT_SECRET: bbbbbbbbbbbbbb
IDP_SERVICE_ACCOUNT: cccccccccccccc
jwt_claims_headers: "user,email"

cookie_domain: ".mydomain.com"

signing_key: fffffffffffffff=
cookie_secret: ddddddddddddd

# https://www.pomerium.io/configuration/#policy
policy:
  - from: https://myapp.mydomain.com
    to: http://xxxxxx:8080
    allowed_domains:
      - mydomain.com

```

## What did you see in the logs?

redacted log:

[https://store6.gofile.io/download/bdb5bf4a-ad2e-4b2a-878a-9355c8fa3a77/pomerium-log-redacted.txt](https://store6.gofile.io/download/bdb5bf4a-ad2e-4b2a-878a-9355c8fa3a77/pomerium-log-redacted.txt)

redacted chrome har:

[https://store6.gofile.io/download/8beb76f7-ab1a-4280-b527-35257d120125/pomerium\_sign\_out.har](https://store6.gofile.io/download/8beb76f7-ab1a-4280-b527-35257d120125/pomerium_sign_out.har)