Hi,
We are implementing Single Sign-Out across multiple applications (Hub A and portals B, C, D, etc.).
When a user logs out from portal B, we trigger an End Session request and the logout is propagated to the other applications. However, we noticed that an access token issued before logout can still be used to successfully call APIs until it expires.
Is this expected behavior? If so, what is the recommended approach to ensure that access tokens become unusable immediately after logout?
Thanks!