Hi, I need to destory a session for a given user. (Using sso at the moment) but my users can logout of my main website but I want them to be able logged out of the forum at the same time. Here’s what I’ve tried (cut down test) $ch = curl_init(); curl_setopt($ch, CURLOPT_URL, 'https://forum.blah.com/session/admin1?api_key= =&api_username=system'); curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1); curl_setopt($ch, CURLOPT_HEADER, 1); curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1); curl_setopt($ch, CURLOPT_CUSTOMREQUEST, "DELETE"); $response = curl_exec($ch); var_dump($response); I get a 302 redirect ever time. But if I do a delete from postman with the same url it works perfectly… What am I missing?!

Where do you get redirected to, and what do the app logs say about the request?

Hi Matt, thanks for the reply. I’ve change the domain to forum.blah.uk but here’s the response otherwise unchanged: HTTP/1.1 302 Found\r\n Server: nginx\r\n Date: Tue, 06 Sep 2016 22:45:27 GMT\r\n Content-Type: text/html; charset=utf-8\r\n Transfer-Encoding: chunked\r\n Connection: keep-alive\r\n X-Frame-Options: SAMEORIGIN\r\n X-XSS-Protection: 1; mode=block\r\n X-Content-Type-Options: nosniff\r\n X-Discourse-Username: system\r\n X-Discourse-Route: session/destroy\r\n Location: https://forum.blah.uk/\r\n Set-Cookie: _forum_session=OERYWXRwYzlOY015T0lsT1ZJTzFKUlgwMnp3U2Uyd21lU1FXM3d5d0pzbXBXbXZUaDhzSG9QUFRUSi9iVlRaamNOS1I0bkExTzNqRzZEcWowVVl6S2c9PS0tbXNwR2p1aVJpZENHcVZ1V2plWmhNQT09--3e85c9bbc1ba07ef0131817b2576c9b4bbdaf1f2; path=/; HttpOnly\r\n X-Request-Id: 16368f90-e840-4c55-8e66-7a4bb600c5b3\r\n X-Runtime: 0.048811\r\n Strict-Transport-Security: max-age=6912000\r\n X-UA-Compatible: IE=edge\r\n \r\n HTTP/1.1 404 Not Found\r\n Server: nginx\r\n Date: Tue, 06 Sep 2016 22:45:27 GMT\r\n Content-Type: text/html; charset=utf-8\r\n Content-Length: 0\r\n Connection: keep-alive\r\n X-Request-Id: cf4a6822-f53d-4360-8250-b0a94bb924de\r\n X-Runtime: 0.022277\r\n \r\n Can’t see anything in the error logs :persevere:

Looking at the code, the redirect is actually expected behaviour… sort of: def destroy reset_session log_off_user if request.xhr? render nothing: true else redirect_to (params[:return_url] || path("/")) end end If you add an X-Requested-With: XMLHTTPRequest header to your request, that’ll suppress the redirect, and you’ll get an empty-body 200 OK instead.

Cool I’ll give it a go. Thanks

Destroying a users session via api

Development

mb450 (Matt) Septembre 7, 2016, 9:25 6

@mpalmer you sir are a legend

Sujet		Réponses	Vues
'/admin/users/{id}/log_out.json' is not working Development rest-api	15	1253	Septembre 6, 2023
/admin/users/1/log_out route error SSO	2	1742	Mai 26, 2020
How to obtain the user_id so I can issue a logout API call SSO	12	3432	Novembre 15, 2018
Web app logout request CORS issues Product Support	2	535	Novembre 30, 2021
What exactly goes on when DELETE /session/username is invoked? Development	5	1589	Décembre 9, 2016

Destroying a users session via api

Sujets connexes