Remove state cookie from browser upon cancelling a login attempt

[varkychen]

We use an Apache reverse proxy (with mod_auth_openidc plugin) and PingFed to federate logins to our application. One of the IdPs PingFed federates with is a custom email based login mechanism for Users to register and access our application. Each login attempt is tracked by a state cookie. How can we instruct the reverse proxy (via Pingfed) to remove the state cookie if the user cancels the login attempt ?

• Can the application (directly or via PingFed) request the reverse proxy to tear-down the login attempt ? Something on the lines of a logout URL using the state parameter value passed in to exactly match the login attempt ?

[varkychen]

Can we tear-down the login attempt by calling a url like /callback?error=login_required&state=akicbnaw&error_uri=https://google.com on the reverse proxy ?

[zandbelt]

yes, that should work