I am invoking this endpoint using a CSRF token just like the Discourse UI does. Observing the backend logs seems to indicate that the session is deleted on some level, but this seems to have no effect on logging the user out. E.g. if I make this call to delete but do not wipe the user’s _t cookie, t…

app/controllers/session_controller.rb master server_session["user_created_message"] = activation.message return redirect_to(users_account_created_path) else login_sso_user(sso, user) end # If it'…

@sam thanks for your quick reply. I do not want log out strict. It logs the user out of every session on every device, I just want to log the user out on the current device. I am logging the user out of Discourse as part of my own site’s logout flow. Discourse is a subdomain of my domain, so my endp…

With user api you get a unique token per device but protocol is somewhat more complex

@riking Thanks for bringing that up. It would be awesome if there were a way to invalidate a specific single session by making an API call from another back end server to the discourse back end, instead of having to redirect the client to the right discourse endpoint or wipe their token cookie. Howe…

What exactly goes on when DELETE /session/username is invoked?

Development

riking (Kane York) 9 Dicembre 2016, 6:23am 4

Of course, it would be nice if every device got a unique login token; then they could be revoked/deleted individually.

Argomento		Risposte	Visualizzazioni
How to fully logout user session plus clear oauth data SSO oauth2	0	1060	Aprile 20, 2023
Is Discourse supposed to log you out across browsers? Feature	9	1932	Settembre 21, 2015
How to log out user if I don't know them? Development	6	1287	Marzo 26, 2020
A question about user_auth_tokens Development	4	1100	Marzo 16, 2017
WordPress log out everywhere doesn't log out discourse WordPress	5	1036	Giugno 24, 2020

What exactly goes on when DELETE /session/username is invoked?

Argomenti correlati