title: Cognito logout does not work as documented
body: <p>I have a Cognito user pool configured with a SAML identity provider (ADFS) and I'm able to sign it as a federated user (AD) but sign out does not work.</p>
  
  <p>Following the <a href="https://docs.aws.amazon.com/cognito/latest/developerguide/logout-endpoint.html" rel="noreferrer">documentation</a>, I make a GET request to 
  <a href="https://my-domain.auth.us-west-2.amazoncognito.com/logout?client_id=63...ng&amp;logout_uri=http:%2F%2Fyahoo.com" rel="noreferrer">https://my-domain.auth.us-west-2.amazoncognito.com/logout?client_id=63...ng&amp;logout_uri=http:%2F%2Fyahoo.com</a> (using some public logout uri), from my client (an AngularJS 1.x app), and I get back a 302 with a <strong>Location</strong> header like  </p>
  
  <pre><code>https://my-domain.auth.us-west-2.amazoncognito.com/login?client_id=63...ng&amp;logout_uri=http:%2F%2Fyahoo.com  
  </code></pre>
  
  <p>(In fact there I see 2 requests like the above).  </p>
  
  <p>When I log back in (thru ADFS) it does not prompt for my AD credentials, i.e. seems that I'm not logged out.</p>
  
  <p>My user pool is configured as described <a href="https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pools-managing-saml-idp-console.html" rel="noreferrer">here</a> (see step 7), where the <strong>Enable IdP sign out flow</strong> is checked, which is supposed to log the user out from ADFS as well.</p>
  
  <p>Any suggestions?
  Thanks.</p>
  
  <pre><code>General
  -------
  Request URL: https://my-domain.auth.us-west-2.amazoncognito.com/logout?client_id=63...ng&amp;logout_uri=http:%2F%2Fyahoo.com  
  Request Method: GET  
  Status Code: 302  
  Remote Address: 54.69.30.36:443  
  Referrer Policy: no-referrer-when-downgrade  
  
  Response Headers
  ----------------
  cache-control: private  
  content-length: 0  
  date: Fri, 20 Apr 2018 21:31:12 GMT  
  expires: Thu, 01 Jan 1970 00:00:00 UTC  
  location: https://my-domain.auth.us-west-2.amazoncognito.com/login?client_id=63...ng&amp;logout_uri=http:%2F%2Fyahoo.com  
  server: Server  
  set-cookie: XSRF-TOKEN=...; Path=/; Secure; HttpOnly  
  set-cookie: XSRF-TOKEN=""; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/; Secure; HttpOnly  
  status: 302  
  strict-transport-security: max-age=31536000 ; includeSubDomains  
  x-content-type-options: nosniff  
  x-frame-options: DENY  
  x-xss-protection: 1; mode=block  
  
  Request Headers
  ---------------
  :authority: my-domain.auth.us-west-2.amazoncognito.com  
  :method: GET  
  :path: /logout?client_id=63...ng&amp;logout_uri=http:%2F%2Fyahoo.com  
  :scheme: https
  accept: application/json, text/plain, */*  
  accept-encoding: gzip, deflate, br  
  accept-language: en-US,en;q=0.9  
  authorization: Bearer eyJra...  
  cache-control: no-cache  
  origin: https://localhost:8443  
  pragma: no-cache  
  referer: https://localhost:8443/logout  
  user-agent: Mozilla/5.0...  
  </code></pre>