diff --git a/src/main/java/com/redhat/ecosystemappeng/exploitiq/rest/TokenResource.java b/src/main/java/com/redhat/ecosystemappeng/exploitiq/rest/TokenResource.java
index 6b6b39ab..d1f6a8ac 100644
--- a/src/main/java/com/redhat/ecosystemappeng/exploitiq/rest/TokenResource.java
+++ b/src/main/java/com/redhat/ecosystemappeng/exploitiq/rest/TokenResource.java
@@ -33,6 +33,7 @@ public class TokenResource {
     @Inject
     UserService userService;
 
+
     @GET
     @Produces("application/json")
     @Operation(hidden = true)
@@ -41,9 +42,9 @@ public String getUserName() {
     }
 
     /**
-     * Performs a local logout using the standard 'Clear-Site-Data' header.
-     * This feature is available only in secure contexts (HTTPS)
-     * https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Clear-Site-Data
+     * Performs logout based on the authentication provider:
+     * - For AWS Cognito: redirects to /logout endpoint to trigger Cognito logout
+     * - For Keycloak and OpenShift OAuth: uses Clear-Site-Data header
      */
     @POST
     @Path("/logout")
@@ -51,6 +52,8 @@ public String getUserName() {
     @Operation(hidden = true)
     @PermitAll
     public Response logout() {
+        // Use Clear-Site-Data header to clear cookies and storage
+        // Works for all OIDC providers (Cognito, Keycloak, OpenShift OAuth)
         return Response.ok(LOGGED_OUT_HTML)
                 .header("Clear-Site-Data", "\"cookies\", \"storage\"")
                 .build();
diff --git a/src/main/resources/application.properties b/src/main/resources/application.properties
index a90ddb19..8451450a 100644
--- a/src/main/resources/application.properties
+++ b/src/main/resources/application.properties
@@ -142,8 +142,9 @@ quarkus.oidc.authentication.java-script-auto-redirect=false
 # ==============================================================================
 
 # Allow logout for all authenticated users (even without roles)
-quarkus.http.auth.permission.logout.paths=/api/v1/user/logout
-quarkus.http.auth.permission.logout.policy=permit
+# Named "auth-logout" to be processed before "default" permission (alphabetical order)
+quarkus.http.auth.permission.auth-logout.paths=/api/v1/user/logout,/q/oidc/logout
+quarkus.http.auth.permission.auth-logout.policy=permit
 
 
 # Allow health endpoints (for monitoring)