Why we need sid security?

[littlefisher666]

#1185

I read the code about 'sid security', but when I use 'spring-boot-starter-oauth2-client' to logout, the sessionId cannot be found anymore.

OidcBackChannelLogoutFilter in spring-boot-starter-oauth2-client get sid from id_token which is encoded.
OidcBackChannelLogoutHandler in spring-boot-starter-oauth2-client send http request to authorization-server to logout with encoded sid in cookie.

But it cannot be found in authorization-server with the encoded sessionId in HttpServletRequest