Describe the bug

The OIDC RP-Initiated Logout endpoint (/application/o//end-session/) is completely non-functional. It does not:

1. Invalidate the session - After hitting end-session, subsequent requests still show the user as authenticated
2. Create a logout event - No logout event appears in the events log
3. Honor post_logout_redirect_uri - Displays static "Logout successful" page regardless of valid redirect URI
4. Execute the invalidation flow - The configured default-provider-invalidation-flow is never triggered

How to reproduce

1. Log out
2. Plain page "Logout successful"
3. USER STILL LOGGED IN

• Static HTML page saying "Logout successful"
• Session remains valid
• No redirect
• No logout event

Expected behavior

• Session should be invalidated
  • User should be redirected to post_logout_redirect_uri if it matches registered redirect URIs
  • Logout event should be created

Screenshots

No response

Additional context

No response

Deployment Method

Docker

Version

2025.10.3

Relevant log output

Request to end-session:
  GET /application/o/<app>/end-session/?id_token_hint=<token>&post_logout_redirect_uri=https://myapp.example.com/
  status: 200
  user: "testuser"

  Immediately after, next request:
  user: "testuser"  ← still authenticated

  No logout event created. Compare to standard invalidation flow which correctly creates:
  {"action": "logout", "path": "/api/v3/flows/executor/default-invalidation-flow/"}