# What exactly goes on when DELETE /session/username is invoked?

**URL:** <https://meta.discourse.org/t/what-exactly-goes-on-when-delete-session-username-is-invoked/53993>\
**Category:** Development\
**Created:** [12월 9, 2016, 12:37오전 UTC](https://meta.discourse.org/t/what-exactly-goes-on-when-delete-session-username-is-invoked/53993 "2016-12-09T00:37:56Z")\
**Posts on this page:** 1\
**Showing post:** 1

<div class="post-metadata">

**Author:** ![Kevin\_Wildenradt](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/kevin_wildenradt/32/62507_2.png) [@Kevin\_Wildenradt](https://meta.discourse.org/u/Kevin_Wildenradt)\
**Post date:** [12월 9, 2016, 12:37오전 UTC](https://meta.discourse.org/t/what-exactly-goes-on-when-delete-session-username-is-invoked/53993/1 "2016-12-09T00:37:56Z")

</div>

I am invoking this endpoint using a CSRF token just like the Discourse UI does. Observing the backend logs seems to indicate that the session is deleted on some level, but this seems to have no effect on logging the user out. E.g. if I make this call to delete but do not wipe the user’s \_t cookie, they are not logged out, even if I wipe the session cookie. It would seem that as long as I can wipe the browser’s \_t cookie the user is logged out, and that making the call to DELETE /session/username is effectively useless. Is there any actual back end cleanup going on here, or is this endpoint just a way for the discourse backend to wipe the browser’s cookie?

---

_[View the full topic](https://meta.discourse.org/t/what-exactly-goes-on-when-delete-session-username-is-invoked/53993)._