Destroying a users session via api

Development
4

Looking at the code, the redirect is actually expected behaviour… sort of:

def destroy
  reset_session
  log_off_user
  if request.xhr?
    render nothing: true
  else
    redirect_to (params[:return_url] || path("/"))
  end
end

If you add an X-Requested-With: XMLHTTPRequest header to your request, that’ll suppress the redirect, and you’ll get an empty-body 200 OK instead.