#### [Abblix\.SecurityEvents](https://www.abblix.com/en/docs/api/abblix-securityevents 'index')
### [Abblix\.SecurityEvents\.BackChannelLogout](https://www.abblix.com/en/docs/api/abblix-securityevents/Abblix.SecurityEvents.BackChannelLogout 'Abblix\.SecurityEvents\.BackChannelLogout')

## LogoutTokenValidator Class

Validates Logout Tokens arriving at this receiver's back\-channel logout endpoint\.

```csharp
public sealed class LogoutTokenValidator : Abblix.SecurityEvents.BackChannelLogout.ILogoutTokenValidator
```

Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → LogoutTokenValidator

Implements [ILogoutTokenValidator](https://www.abblix.com/en/docs/api/abblix-securityevents/Abblix.SecurityEvents.BackChannelLogout.ILogoutTokenValidator 'Abblix\.SecurityEvents\.BackChannelLogout\.ILogoutTokenValidator')

### Remarks
Steps 1 to 7 of OpenID Connect Back\-Channel Logout 1\.0 Section 2\.6 are the profile's, which is
why this class is short: the signature, the algorithm and the iss, aud, iat and exp claims are
the steps the specification defines by reference to ID Token validation, and the profile
carries them along with the logout event, the absent nonce and the subject or session\. What is
left here is step 8 and the notification the host acts on\.

Step 1, decryption, does not arise: this receiver registers no encryption algorithm for the
endpoint, so an encrypted token is one it never asked for and the JOSE layer refuses.
### Constructors

## LogoutTokenValidator\(ISecurityEventTokenValidator, BackChannelLogoutValidationOptions, IReplayCache\) Constructor {#Abblix.SecurityEvents.BackChannelLogout.LogoutTokenValidator.LogoutTokenValidator(Abblix.SecurityEvents.Validation.ISecurityEventTokenValidator,Abblix.SecurityEvents.BackChannelLogout.BackChannelLogoutValidationOptions,Abblix.Jwt.ReplayPrevention.IReplayCache)}

Validates Logout Tokens arriving at this receiver's back\-channel logout endpoint\.

```csharp
public LogoutTokenValidator(Abblix.SecurityEvents.Validation.ISecurityEventTokenValidator validator, Abblix.SecurityEvents.BackChannelLogout.BackChannelLogoutValidationOptions options, Abblix.Jwt.ReplayPrevention.IReplayCache replayCache);
```
#### Parameters

###### `validator` [ISecurityEventTokenValidator](https://www.abblix.com/en/docs/api/abblix-securityevents/Abblix.SecurityEvents.Validation.ISecurityEventTokenValidator 'Abblix\.SecurityEvents\.Validation\.ISecurityEventTokenValidator') {#Abblix.SecurityEvents.BackChannelLogout.LogoutTokenValidator.LogoutTokenValidator(Abblix.SecurityEvents.Validation.ISecurityEventTokenValidator,Abblix.SecurityEvents.BackChannelLogout.BackChannelLogoutValidationOptions,Abblix.Jwt.ReplayPrevention.IReplayCache).validator}

The validation pipeline, resolved from this receiver's own named profile
\([LogoutToken](https://www.abblix.com/en/docs/api/abblix-securityevents/Abblix.SecurityEvents.Infrastructure.ValidationProfileKeys#Abblix.SecurityEvents.Infrastructure.ValidationProfileKeys.LogoutToken 'Abblix\.SecurityEvents\.Infrastructure\.ValidationProfileKeys\.LogoutToken')\) \- never the host's plain family,
which another consumer of security event tokens may have shaped to refuse every Logout Token\.

###### `options` [BackChannelLogoutValidationOptions](https://www.abblix.com/en/docs/api/abblix-securityevents/Abblix.SecurityEvents.BackChannelLogout.BackChannelLogoutValidationOptions 'Abblix\.SecurityEvents\.BackChannelLogout\.BackChannelLogoutValidationOptions') {#Abblix.SecurityEvents.BackChannelLogout.LogoutTokenValidator.LogoutTokenValidator(Abblix.SecurityEvents.Validation.ISecurityEventTokenValidator,Abblix.SecurityEvents.BackChannelLogout.BackChannelLogoutValidationOptions,Abblix.Jwt.ReplayPrevention.IReplayCache).options}

What this receiver expects of every Logout Token\.

###### `replayCache` [IReplayCache](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ReplayPrevention.IReplayCache 'Abblix\.Jwt\.ReplayPrevention\.IReplayCache') {#Abblix.SecurityEvents.BackChannelLogout.LogoutTokenValidator.LogoutTokenValidator(Abblix.SecurityEvents.Validation.ISecurityEventTokenValidator,Abblix.SecurityEvents.BackChannelLogout.BackChannelLogoutValidationOptions,Abblix.Jwt.ReplayPrevention.IReplayCache).replayCache}

Remembers tokens already acted on, which is step 8\.

### Remarks
Steps 1 to 7 of OpenID Connect Back\-Channel Logout 1\.0 Section 2\.6 are the profile's, which is
why this class is short: the signature, the algorithm and the iss, aud, iat and exp claims are
the steps the specification defines by reference to ID Token validation, and the profile
carries them along with the logout event, the absent nonce and the subject or session\. What is
left here is step 8 and the notification the host acts on\.

Step 1, decryption, does not arise: this receiver registers no encryption algorithm for the
endpoint, so an encrypted token is one it never asked for and the JOSE layer refuses.
### Methods

## LogoutTokenValidator\.ValidateAsync\(string, CancellationToken\) Method {#Abblix.SecurityEvents.BackChannelLogout.LogoutTokenValidator.ValidateAsync(string,System.Threading.CancellationToken)}

Validates [logoutToken](https://www.abblix.com/en/docs/api/abblix-securityevents/Abblix.SecurityEvents.BackChannelLogout.LogoutTokenValidator#Abblix.SecurityEvents.BackChannelLogout.LogoutTokenValidator.ValidateAsync(string,System.Threading.CancellationToken).logoutToken 'Abblix\.SecurityEvents\.BackChannelLogout\.LogoutTokenValidator\.ValidateAsync\(string, System\.Threading\.CancellationToken\)\.logoutToken') and returns which sessions it says to end\.

```csharp
public System.Threading.Tasks.Task<Abblix.SecurityEvents.BackChannelLogout.LogoutNotification> ValidateAsync(string logoutToken, System.Threading.CancellationToken cancellationToken=default(System.Threading.CancellationToken));
```
#### Parameters

###### `logoutToken` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.SecurityEvents.BackChannelLogout.LogoutTokenValidator.ValidateAsync(string,System.Threading.CancellationToken).logoutToken}

The encoded Logout Token from the `logout_token` parameter\.

###### `cancellationToken` [System\.Threading\.CancellationToken](https://learn.microsoft.com/en-us/dotnet/api/system.threading.cancellationtoken 'System\.Threading\.CancellationToken') {#Abblix.SecurityEvents.BackChannelLogout.LogoutTokenValidator.ValidateAsync(string,System.Threading.CancellationToken).cancellationToken}

Cancels the key\-set and metadata reads this may need\.

Implements [ValidateAsync\(string, CancellationToken\)](https://www.abblix.com/en/docs/api/abblix-securityevents/Abblix.SecurityEvents.BackChannelLogout.ILogoutTokenValidator#Abblix.SecurityEvents.BackChannelLogout.ILogoutTokenValidator.ValidateAsync(string,System.Threading.CancellationToken) 'Abblix\.SecurityEvents\.BackChannelLogout\.ILogoutTokenValidator\.ValidateAsync\(string, System\.Threading\.CancellationToken\)')

#### Returns
[System\.Threading\.Tasks\.Task&lt;](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[LogoutNotification](https://www.abblix.com/en/docs/api/abblix-securityevents/Abblix.SecurityEvents.BackChannelLogout.LogoutNotification 'Abblix\.SecurityEvents\.BackChannelLogout\.LogoutNotification')[&gt;](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')  
What the token says to act on\.

#### Exceptions

[LogoutTokenValidationException](https://www.abblix.com/en/docs/api/abblix-securityevents/Abblix.SecurityEvents.BackChannelLogout.LogoutTokenValidationException 'Abblix\.SecurityEvents\.BackChannelLogout\.LogoutTokenValidationException')  
The token failed a validation step\. Section 2\.6: "If any of the validation steps fails, reject the
Logout Token and return an HTTP 400 Bad Request error\."

### Remarks
Steps 8 to 11 of section 2\.6 are each introduced with "Optionally", and each needs something only the
host has: a record of tokens recently seen, or the ID Token of the session being ended\. They are left
to the host, which holds the sessions this notification is about, and which section 2\.7 makes
responsible for locating them anyway\.