Hey everyone, thanks for Discourse I’ve find it pretty easy to set up, up until this point. I have a SSO setup that works fine with my web app, however when I trigger the admin/users/:id/logout endpoint, it won’t work from the web app. For some reason it’ll accept a cURL just fine: curl 'http://localhost/admin/users/2/log_out' \ -X 'POST' \ -H 'Api-Key: <>' \ -H 'Content-Type: multipart/form-data;' -v * Trying 127.0.0.1:80... * Connected to localho.st (127.0.0.1) port 80 (#0) > POST /admin/users/2/log_out HTTP/1.1 > Host: localho.st > User-Agent: curl/7.77.0 > Accept: */* > Api-Key: <> > Content-Type: multipart/form-data; > * Mark bundle as not supporting multiuse < HTTP/1.1 200 OK < Content-Type: application/json; charset=utf-8 < Transfer-Encoding: chunked < Connection: keep-alive < Status: 200 OK < Cache-Control: no-cache, no-store < Access-Control-Allow-Origin: http://localhost:3000 < Vary: Accept < Referrer-Policy: strict-origin-when-cross-origin < X-Permitted-Cross-Domain-Policies: none < X-XSS-Protection: 1; mode=block < X-Request-Id: 26dfcbf6-497c-45db-8e3d-17aef9ba812c < X-Discourse-Route: users/log_out < Access-Control-Allow-Headers: Content-Type, Cache-Control, X-Requested-With, X-CSRF-Token, Discourse-Present, User-Api-Key, User-Api-Client-Id, Authorization < Access-Control-Allow-Credentials: true < Access-Control-Allow-Methods: POST, PUT, GET, OPTIONS, DELETE < X-Download-Options: noopen < X-Runtime: 0.190266 < X-Frame-Options: SAMEORIGIN < X-Content-Type-Options: nosniff < X-Discourse-Username: emurillo "2"} Can't verify CSRF token authenticity. Completed 200 OK in 75ms (Views: 0.9ms | ActiveRecord: 0.0ms | Allocations: 2350) But then when I try from the web app: axios.post('http://localhost/admin/users/2/log_out', {}, { headers: { 'User-Api-Key': '<>', 'Content-Type': 'multipart/form-data' } }); the server logs show: Started POST "/admin/users/2/log_out" for 172.18.0.1 at 2021-11-30 21:08:26 +0000 ActionController::RoutingError (No route matches [POST] "/admin/users/2/log_out") some more evidence: [Screen Shot 2021-11-30 at 15.10.37] xxxxxxxxxxx [Screen Shot 2021-11-30 at 15.11.13] xxxxxxxxxxx [Screen Shot 2021-11-30 at 15.11.51]

That’s right, wanted to verify first in the front-end, but if you recommend setting up an endpoint on my server to handle the logout (and there is no shorter path around it) I’ll follow your advice.

Web app logout request CORS issues

Product Support

Falco (Falco) November 30, 2021, 9:55pm 2

What do you mean by “from the webapp”. Are you trying to call this API endpoint from front-end javascript? That would expose the admin API key.

Topic		Replies	Views
SSO Log out - CORS issue SSO	2	1286	July 4, 2020
'/admin/users/{id}/log_out.json' is not working Development rest-api	15	1262	September 6, 2023
/admin/users/1/log_out route error SSO	2	1745	May 26, 2020
How to logout user by api Product Support rest-api	1	171	October 24, 2025
API CORS Headers Incorrect Product Support	10	3222	July 6, 2020

Web app logout request CORS issues

Related topics