What exactly goes on when DELETE /session/username is invoked?

sam · December 9, 2016, 12:44am

app/controllers/session_controller.rb

master


      
            server_session["user_created_message"] = activation.message
            return redirect_to(users_account_created_path)
          else
            login_sso_user(sso, user)
          end
          
          # If it's not a relative URL check the host
          if return_path !~ %r{\A/[^/]}
            begin

github.com/discourse/discourse

lib/current_user.rb

5dbd6a304


      
          def log_off_user
            current_user_provider.log_off_user(session,cookies)
          end

github.com/discourse/discourse

lib/auth/default_current_user_provider.rb

b246f1a69


      
          def log_off_user(session, cookies)
            if SiteSetting.log_out_strict && (user = current_user)
              user.auth_token = nil
              user.save!
          
              if user.admin && defined?(Rack::MiniProfiler)
                # clear the profiling cookie to keep stuff tidy
                cookies.delete("__profilin")
              end
          
              user.logged_out
            end
            cookies.delete(TOKEN_COOKIE)
          end

I think what you are after is SiteSetting.log_out_strict

Topic		Replies	Views
How to fully logout user session plus clear oauth data SSO oauth2	0	1060	April 20, 2023
Is Discourse supposed to log you out across browsers? Feature	9	1932	September 21, 2015
How to log out user if I don't know them? Development	6	1286	March 26, 2020
A question about user_auth_tokens Development	4	1100	March 16, 2017
WordPress log out everywhere doesn't log out discourse WordPress	5	1036	June 24, 2020

What exactly goes on when DELETE /session/username is invoked?

Related topics