I have gotten logout to work with our webapp by having a logoutIntercepter redirect the users browser to the gluu end_session endpoint and put the id_token_hint as a query parameter and this works great. We have another use case where the user's session times out due to inactivity. When this happens we can capture this event with a servlet.session.destroy.events=MyEventHandlerClass The problem here is that I only get an instance of the HttpSession when this eventHandler fires, so how can I call end_session and successfully kill the session between the browser and Gluu. If I pass the id_token_hint and the session_id will it work if I call end_session endpoint like a get REST service instead of redirecting the user's browser to that address? But then how could my app know the browser's gluu session_id?