# "User Log out API" return success in response but user session still alive
**URL:** https://meta.discourse.org/t/user-log-out-api-return-success-in-response-but-user-session-still-alive/91468
**Category:** SSO
**Created:** [3 juli 2018 om 11:50 UTC](https://meta.discourse.org/t/user-log-out-api-return-success-in-response-but-user-session-still-alive/91468 "2018-07-03T11:50:04Z")
**Posts on this page:** 11
**Page:** 1
### Author:  [@kalpantkrishna\_patil](https://meta.discourse.org/u/kalpantkrishna_patil)
#### Post date: [3 juli 2018 om 11:50 UTC](https://meta.discourse.org/t/user-log-out-api-return-success-in-response-but-user-session-still-alive/91468/1 "2018-07-03T11:50:05Z")
Hi,
I’m using SSO settings and calling User Log out API ([https://discourse.example.com/admin/users/{id}/log\_out](https://discourse.example.com/admin/users/%7Bid%7D/log_out)) from my application. Now API returns **Success** in response but user session still alive in browser. what should be the cause?
-Another issue is that Group is not getting set to User while passing from returnPayload.
---
### Author:  [@vinothkannans](https://meta.discourse.org/u/vinothkannans)
#### Post date: [3 juli 2018 om 13:09 UTC](https://meta.discourse.org/t/user-log-out-api-return-success-in-response-but-user-session-still-alive/91468/2 "2018-07-03T13:09:10Z")
> [@Setup DiscourseConnect - Official Single-Sign-On for Discourse (sso)](https://meta.discourse.org/t/setup-discourseconnect-official-single-sign-on-for-discourse-sso/13045/1):
>
> If no URL has been set here you will be redirected back to the URL configured in `sso url` .
Before calling the API did you logged-out the user in your application? Also try `verbose_sso_logging` to debug.
---
### Author:  [@kalpantkrishna\_patil](https://meta.discourse.org/u/kalpantkrishna_patil)
#### Post date: [4 juli 2018 om 06:55 UTC](https://meta.discourse.org/t/user-log-out-api-return-success-in-response-but-user-session-still-alive/91468/3 "2018-07-04T06:55:12Z")
Yes, I’m calling “log out API” after user logout from our application. I observed logs on ([xxxxx.trydiscourse.com/logs](http://xxxxx.trydiscourse.com/logs)) but seeing only warning there and no Errors/Fatal.
Note: I’m using discourse trial instance for now and user **Group** passing(in return payload) functionality is also not working.
---
### Author:  [@vinothkannans](https://meta.discourse.org/u/vinothkannans)
#### Post date: [4 juli 2018 om 14:06 UTC](https://meta.discourse.org/t/user-log-out-api-return-success-in-response-but-user-session-still-alive/91468/4 "2018-07-04T14:06:18Z")
Can you paste the code you are using to call the API and SSO? Then you may get more support from other community members too.
---
### Author:  [@kalpantkrishna\_patil](https://meta.discourse.org/u/kalpantkrishna_patil)
#### Post date: [5 juli 2018 om 12:40 UTC](https://meta.discourse.org/t/user-log-out-api-return-success-in-response-but-user-session-still-alive/91468/5 "2018-07-05T12:40:53Z")
```
==============API call==============
public void LogoutDiscourse()
{
string apiKey = ConfigurationManager.AppSettings["discourse_api_key"];
string apiUsername = ConfigurationManager.AppSettings["discourse_api_username"];
string url = "https://xxxxxxx.trydiscourse.com/admin/users/" + userId + "/log_out?api_key=" + apiKey + "&api_username=" + apiUsername;
string response = CalloutDiscourseApi(url);
}
public string CalloutDiscourseApi(string apiUrl)
{
//HttpWebResponse response = null;
StreamReader respStream = null;
// Create a request object using the url passed in
var request = (HttpWebRequest)WebRequest.Create(apiUrl);
request.Method = "POST";
request.Timeout = 10000;
//Set the content type of the data being posted.
request.ContentType = "multipart/form-data";
using (var response = (HttpWebResponse)request.GetResponse())
{
// Create a streamreader object from the response
respStream = new StreamReader(response.GetResponseStream(), Encoding.UTF8);
// Get the contents of the page as a string and return it
return respStream.ReadToEnd();
}
}
===========SSO - Group passing==========
////Skipping few initial line of code here
string userGroups = "CustomGroup";
var result = userRegistration.GetUserSpecificDetails(actualCriteria);
objUserProfileDetails = (List)(serialization.DeSerializeBinary(Convert.ToString(result)));
var UserProfileDetails = objUserProfileDetails.FirstOrDefault();
string returnPayload = "nonce=" + Server.UrlEncode(nonce) +
"&email=" + Server.UrlEncode(UserProfileDetails.Email) +
"&external_id=" + Server.UrlEncode(UserProfileDetails.ID.ToString()) +
"&username=" + Server.UrlEncode(UserProfileDetails.Email) +
"&name=" + Server.UrlEncode(UserProfileDetails.Name) +
"&add_groups=" + Server.UrlEncode(userGroups);
string encodedPayload = Convert.ToBase64String(Encoding.UTF8.GetBytes(returnPayload));
string returnSig = getHash(encodedPayload, ssoSecret);
string redirectUrl = ConfigurationManager.AppSettings["DiscourseUrl"] + "/session/sso_login?sso=" + encodedPayload + "&sig=" + returnSig;
return Redirect(redirectUrl);
```
---
### Author:  [@kalpantkrishna\_patil](https://meta.discourse.org/u/kalpantkrishna_patil)
#### Post date: [9 juli 2018 om 08:36 UTC](https://meta.discourse.org/t/user-log-out-api-return-success-in-response-but-user-session-still-alive/91468/6 "2018-07-09T08:36:03Z")
Any updates/help on above queries please
---
### Author:  [@kalpantkrishna\_patil](https://meta.discourse.org/u/kalpantkrishna_patil)
#### Post date: [10 juli 2018 om 05:58 UTC](https://meta.discourse.org/t/user-log-out-api-return-success-in-response-but-user-session-still-alive/91468/7 "2018-07-10T05:58:12Z")
Hi @vinothkannans ,
Does API’s and add\_groups works on trial instance?
---
### Author:  [@vinothkannans](https://meta.discourse.org/u/vinothkannans)
#### Post date: [10 juli 2018 om 06:35 UTC](https://meta.discourse.org/t/user-log-out-api-return-success-in-response-but-user-session-still-alive/91468/8 "2018-07-10T06:35:49Z")
Yes. It should work. Did you enable the site setting `sso_overrides_groups` in admin side?
---
### Author:  [@kalpantkrishna\_patil](https://meta.discourse.org/u/kalpantkrishna_patil)
#### Post date: [10 juli 2018 om 06:43 UTC](https://meta.discourse.org/t/user-log-out-api-return-success-in-response-but-user-session-still-alive/91468/9 "2018-07-10T06:43:44Z")
Yes. PFA
---
### Author:  [@riking](https://meta.discourse.org/u/riking)
#### Post date: [10 juli 2018 om 07:23 UTC](https://meta.discourse.org/t/user-log-out-api-return-success-in-response-but-user-session-still-alive/91468/10 "2018-07-10T07:23:58Z")
I don’t see any error handling anywhere in there – are you sure the calls are succeeding?
A non-200 response still has a body to read.
---
### Author:  [@kalpantkrishna\_patil](https://meta.discourse.org/u/kalpantkrishna_patil)
#### Post date: [10 juli 2018 om 08:29 UTC](https://meta.discourse.org/t/user-log-out-api-return-success-in-response-but-user-session-still-alive/91468/11 "2018-07-10T08:29:43Z")
Yes @riking, It has centralised error handling code. I have debugged this code and got **Response** - {“success”:“OK”}. Also hit this API from postman and got the same response - {“success”:“OK”}