Hi, I need to destory a session for a given user. (Using sso at the moment) but my users can logout of my main website but I want them to be able logged out of the forum at the same time. Here’s what I’ve tried (cut down test) $ch = curl_init(); curl_setopt($ch, CURLOPT_URL, 'https://forum.blah.com/session/admin1?api_key= =&api_username=system'); curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1); curl_setopt($ch, CURLOPT_HEADER, 1); curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1); curl_setopt($ch, CURLOPT_CUSTOMREQUEST, "DELETE"); $response = curl_exec($ch); var_dump($response); I get a 302 redirect ever time. But if I do a delete from postman with the same url it works perfectly… What am I missing?!

Where do you get redirected to, and what do the app logs say about the request?

Hi Matt, thanks for the reply. I’ve change the domain to forum.blah.uk but here’s the response otherwise unchanged: HTTP/1.1 302 Found\r\n Server: nginx\r\n Date: Tue, 06 Sep 2016 22:45:27 GMT\r\n Content-Type: text/html; charset=utf-8\r\n Transfer-Encoding: chunked\r\n Connection: keep-alive\r\n X-Frame-Options: SAMEORIGIN\r\n X-XSS-Protection: 1; mode=block\r\n X-Content-Type-Options: nosniff\r\n X-Discourse-Username: system\r\n X-Discourse-Route: session/destroy\r\n Location: https://forum.blah.uk/\r\n Set-Cookie: _forum_session=OERYWXRwYzlOY015T0lsT1ZJTzFKUlgwMnp3U2Uyd21lU1FXM3d5d0pzbXBXbXZUaDhzSG9QUFRUSi9iVlRaamNOS1I0bkExTzNqRzZEcWowVVl6S2c9PS0tbXNwR2p1aVJpZENHcVZ1V2plWmhNQT09--3e85c9bbc1ba07ef0131817b2576c9b4bbdaf1f2; path=/; HttpOnly\r\n X-Request-Id: 16368f90-e840-4c55-8e66-7a4bb600c5b3\r\n X-Runtime: 0.048811\r\n Strict-Transport-Security: max-age=6912000\r\n X-UA-Compatible: IE=edge\r\n \r\n HTTP/1.1 404 Not Found\r\n Server: nginx\r\n Date: Tue, 06 Sep 2016 22:45:27 GMT\r\n Content-Type: text/html; charset=utf-8\r\n Content-Length: 0\r\n Connection: keep-alive\r\n X-Request-Id: cf4a6822-f53d-4360-8250-b0a94bb924de\r\n X-Runtime: 0.022277\r\n \r\n Can’t see anything in the error logs :persevere:

Looking at the code, the redirect is actually expected behaviour… sort of: def destroy reset_session log_off_user if request.xhr? render nothing: true else redirect_to (params[:return_url] || path("/")) end end If you add an X-Requested-With: XMLHTTPRequest header to your request, that’ll suppress the redirect, and you’ll get an empty-body 200 OK instead.

Cool I’ll give it a go. Thanks

Destroying a users session via api

Development

mb450 (Matt) 7 Septiembre, 2016 09:25 6

@mpalmer you sir are a legend

Tema		Respuestas	Vistas
'/admin/users/{id}/log_out.json' is not working Development rest-api	15	1253	6 Septiembre 2023
/admin/users/1/log_out route error SSO	2	1742	26 Mayo 2020
How to obtain the user_id so I can issue a logout API call SSO	12	3432	15 Noviembre 2018
Web app logout request CORS issues Product Support	2	535	30 Noviembre 2021
What exactly goes on when DELETE /session/username is invoked? Development	5	1589	9 Diciembre 2016

Destroying a users session via api

Temas relacionados