## 4.1.6.3.5 Configure Redirect URLs for Browser Logout
To avoid open redirect attacks, direct users to a safe and valid URL when they log out.
## Prerequisites
- You've an application that is using the application router.
- Use application router 5.7.0 or higher. For more information, see the related link.
## Context
You've deployed an application in the Cloud Foundry environment of SAP BTP. Business users log in and out of the application. As an application developer, you want to set a redirect URI, which directs users to a specific page once they've logged out. This page can be a logout page or your organization's employee portal. For security reasons, there's a check of this redirect URI.
- In the application descriptor ( xs-app.json ), you define a public logout page.
- To avoid redirects, for example to malicious web sites, xsuaa compares this public URL with a list of allowed redirect URLs. You define them in the OAuth 2.0 configuration property of the application security descriptor ( xs-security.json ).
## Procedure
1. Define xs-app.json in the application router folder of your application. Include a logout endpoint and define a logout page (here logout.html ) which can be accessed without authentication.
2. Open a command prompt.
3. Log in to your Cloud Foundry environment using the Cloud Foundry command-line interface (cf CLI).
4. Choose your subaccount.
```
 Sample Code { "welcomeFile": "index.html", "authenticationMethod": "route", "logout": { "logoutEndpoint": "/my/logout", "logoutPage": "logout.html" }, "routes": [{ "source": "^/hw/", "target": "/", "destination": "hw-dest", "scope": { "GET": [ "$XSAPPNAME.Display", "$XSAPPNAME.Update" ], "default": "$XSAPPNAME.Update" } }, { "source": "/index.html", "localDir": "resources", "cacheControl": "no-cache, no-store, must-revalidate" }, { "source": "/logout.html", "localDir": "resources", "authenticationType": "none " }, { "source": "^/(.*)", "localDir": "resources" }] }
```
##  Note
The cf CLI prompts you to choose an org. To find the org of your subaccount, use the cockpit to go to your subaccount. You can find the org in the Cloud Foundry tile under Organization (see Navigate to Orgs and Spaces [page 2512]).
5. Choose the space where your application is located.
6. Deploy the application to your space.
7. To define the redirect URIs, go to the folder where xs-security.json is stored.
8. Define the redirect URIs in the oauth2-configuration property.
9. Add a URL that contains the hostname of your application.
```
 Sample Code { "xsappname": "<application_name>", "tenant-mode": "dedicated", "description": "My Sample Application with Application Router", "oauth2-configuration": { "token-validity": 900, "redirect-uris": [ "https:// <application_hostname>.<landscape_domain>/**" ], "autoapprove": "true" } }
```
```
 Note The application domain is the first part of the application URL: For more information, see the related link.  Example myapplication .cfapps.hana.ondemand.com/**  Example For China (Shanghai) region: myapplication .mycustomdomain.cn/**
```
10. Update the xsuaa service instance that is bound to your application.
cf update-service &lt;service\_instance&gt; -c xs-security.json
<!-- image -->
You've implemented a valid redirect after logout, and xsuaa checks the redirect URL against the list of allowed URIs in the OAuth 2.0 configuration.
## Related Information
```
Application Router [page 439] Configuring Application URLs Update a Service Instance [page 561] Cloud Foundry Command Line Interface Application Security Descriptor Configuration Syntax [page 576] Security Considerations for the SAP Authorization and Trust Management Service [page 3234]
```