By Dhammika on

I am trying to use the user.logout service but I can not find any sample/documentation to get me going.

Here is my sample to log in using cURL: (Works!)

curl -v --data "method=user.login&username=u701@e.com&password=u701" http://localhost:8080/drupal622/myendpoint/user/login
This returned a "sessid":"74q35epc63o2v4brr1e37283p3"

The following requests each failed with an error 406 - 406 Not Acceptable: User is not logged in.

curl -v --data "method=user.logout&sessionID=74q35epc63o2v4brr1e37283p3" http://localhost:8080/drupal622/myendpoint/user/logout

curl -v --data "method=user.logout&sessid=74q35epc63o2v4brr1e37283p3" http://localhost:8080/drupal622/myendpoint/user/logout

Can someone shed some light ?

⋅ Categories: Drupal 6.x, Drupal 7.x

Comments

jnross’s picture

jnross commented

sessid is only used as a parameter in the call to user.login. When user.login returns, a session_name and sessid are returned. This information should be included in subsequent requests as the header "Cookie: =". Here is an example of system.connect, user.login, and user.logout operations using curl:

$ curl http://example.com/services/system/connect -d "" -v
sessid: eb4d98ee2d6647488d3359d4d7990515

$ curl http://example.com/services/user/login -d "username=joe&password=pass&sessid=eb4d98ee2d6647488d3359d4d7990515" -v
sessid: 9cc1a2cfa782d3d614a947a6a48066a0
session_name: SESS46e169b3ee0c2423dbf60ab06d25e9d7

$ curl http://example.com/services/user/logout -d "" -H "Cookie: SESS46e169b3ee0c2423dbf60ab06d25e9d7=9cc1a2cfa782d3d614a947a6a48066a0;" -v
< HTTP/1.1 200 OK

Dhammika’s picture

Dhammika commented

Request :

curl http://127.0.0.1:8080/drupal622/myendpoint/system/connect -d"" -v

Resposne:

{"sessid":"atc8335n25ak2b8d3ii6h04bi4","user":{"uid":0,"hostname":"127.0.0.1","roles":{"1":"anonymous user"},"session":"","cache":0}}

Request:
curl http://127.0.0.1:8080/drupal622/myendpoint/user/login -d"username=user&password=pass&sessid=atc8335n25ak2b8d3ii6h04bi4" -v

* About to connect() to 127.0.0.1 port 8080 (#0)
* Trying 127.0.0.1... connected
* Connected to 127.0.0.1 (127.0.0.1) port 8080 (#0)
> POST /drupal622/myendpoint/user/login HTTP/1.1
> User-Agent: curl/7.19.5 (i586-pc-mingw32msvc) libcurl/7.19.5 zlib/1.2.3
> Host: 127.0.0.1:8080
> Accept: */*
> Content-Length: 61
> Content-Type: application/x-www-form-urlencoded
>
< HTTP/1.1 200 OK
< Date: Sun, 11 Sep 2011 18:37:30 GMT
< Server: Apache/2.2.17 (Win32) PHP/5.3.5
< X-Powered-By: PHP/5.3.5
< Set-Cookie: SESS0902a91cf59c38431753fb2428aaaeea=83hp3e9lqtoaujlerpo9a9n8c0; expires=Tue, 04-Oct-2011 22:10:51 GMT; pa
th=/
< Expires: Sun, 19 Nov 1978 05:00:00 GMT
< Last-Modified: Sun, 11 Sep 2011 18:37:31 GMT
< Cache-Control: store, no-cache, must-revalidate
< Cache-Control: post-check=0, pre-check=0
< Vary: Accept
< Set-Cookie: SESS0902a91cf59c38431753fb2428aaaeea=l3olkdfneiadvrv7t33k0tefu4; expires=Tue, 04-Oct-2011 22:10:52 GMT; pa
th=/
< Set-Cookie: SESS0902a91cf59c38431753fb2428aaaeea=4g05o3hq1r5gnf6i94ev5c01h1; expires=Tue, 04-Oct-2011 22:10:52 GMT; pa
th=/
< Content-Length: 646
< Content-Type: application/json
<
{"sessid":"4g05o3hq1r5gnf6i94ev5c01h1","session_name":"SESS0902a91cf59c38431753fb2428aaaeea","user":{"uid":"3","name":"u
ser","pass":"1a1dc91c907325c69271ddf0c944bc72","mail":"user@abcdefgh.net","mode":"0","sort":"0","threshold":"0","theme":
"","signature":"","signature_format":"0","created":"1309028308","access":"1315765845","login":1315766252,"status":"1","t
imezone":"-14400","language":"","picture":"","init":"user@abcdefg.net","data":"a:1:{s:13:\"form_build_id\";s:37:\"form-
69a6d76484049252cfb469a3bc76266e\";}","timezone_name":"America\/New_York","form_build_id":"form-69a6d76484049252cfb469a3
bc76266e","roles":{"2":"authenticated user"}}}* Connection #0 to host 127.0.0.1 left intact
* Closing connection #0

Request:
curl http://127.0.0.1:8080/drupal622/myendpoint/user/logout -d "" -H "Cookie: SESS0902a91cf59c38431753fb2428aaaeea=4g05o3hq1r5gnf6i94ev5c01h1;" -v

* About to connect() to 127.0.0.1 port 8080 (#0)
* Trying 127.0.0.1... connected
* Connected to 127.0.0.1 (127.0.0.1) port 8080 (#0)
> POST /drupal622/myendpoint/user/logout HTTP/1.1
> User-Agent: curl/7.19.5 (i586-pc-mingw32msvc) libcurl/7.19.5 zlib/1.2.3
> Host: 127.0.0.1:8080
> Accept: */*
> Cookie: SESS0902a91cf59c38431753fb2428aaaeea=4g05o3hq1r5gnf6i94ev5c01h1;
> Content-Length: 0
> Content-Type: application/x-www-form-urlencoded
>
* HTTP 1.0, assume close after body
< HTTP/1.0 406 Not Acceptable: User is not logged in.
< Date: Sun, 11 Sep 2011 18:44:13 GMT
< Server: Apache/2.2.17 (Win32) PHP/5.3.5
< X-Powered-By: PHP/5.3.5
< Expires: Sun, 19 Nov 1978 05:00:00 GMT
< Last-Modified: Sun, 11 Sep 2011 18:44:14 GMT
< Cache-Control: store, no-cache, must-revalidate
< Cache-Control: post-check=0, pre-check=0
< Vary: Accept
< Content-Length: 4
< Connection: close
< Content-Type: application/json
<
null* Closing connection #0

Any suggestions will be much appreciated.

synapticmishap’s picture

synapticmishap commented

Dhammika

What did you end up doing? Did you resolve this issue? I'm having exactly the same problem. No matter what I do, I can't log a user out, or login then do anything an authenticated user would do. It's highly annoying.

synapticmishap’s picture

synapticmishap commented

I've just found a solution to this. It turns out that session authentication wasn't turned on in my REST module.

You need to edit your REST endpoint in the admin panel - Site Building > Services > Edit

Then you'll see a tickbox for Session Authentication. Tick this, press save.

Now the endpoint will have session authentication enabled on it and these calls should work. I just had success for the first time with a node create action.

revnoah’s picture

revnoah commented

I'm also getting a 406 error, only on logout. I can log in as expected, update content and my profile. But when I try to log out, I get a 406 error (not acceptable). Via Javascript, I am posting to a uri in the same format as above, with my session cookie set by using credentials and setting the CSRF token in the request header.

JeffBrower’s picture

JeffBrower commented

I can get a token, make a connection, log in - but I cannot log out. Session Authentication is turned on.

Request headers:

POST /appsvc/user/logout HTTP/1.1
Host: mydomain.mobi
Connection: keep-alive
Content-Length: 4
Accept: application/json, text/javascript, */*; q=0.01
Origin: http://mydomain.mobi
X-CSRF-Token: qgnBXwlf5TbMh3VazbtFvtzn74Z8yUu9O76XB_3Shpk
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/28.0.1500.95 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Referer: http://mydomain.mobi/
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Cookie: Drupal.toolbar.collapsed=0; Drupal.tableDrag.showWeight=0; SESS3e1390c8545608e4cea7121af135d9b2=rjTv1ytfYo7kwoArqQojk4ZokTy76iLdArsxp2zB6yo

Reply:

HTTP/1.1 406 Not Acceptable: User is not logged in.
Date: Sun, 25 Aug 2013 11:46:34 GMT
Server: Apache/2.2.16 (Debian)
X-Powered-By: PHP/5.3.3-7+squeeze8
Expires: Sun, 19 Nov 1978 05:00:00 GMT
Last-Modified: Sun, 25 Aug 2013 11:46:34 GMT
Cache-Control: no-cache, must-revalidate, post-check=0, pre-check=0
ETag: "1377431194"
Vary: Accept
Content-Length: 26
Content-Type: text/javascript
Set-Cookie: SESS3e1390c8545608e4cea7121af135d9b2=deleted; expires=Sat, 25-Aug-2012 11:46:33 GMT; path=/; domain=.mydomain.com; httponly
Keep-Alive: timeout=15, max=100
Connection: Keep-Alive

I am accessing a service through an apache proxy so that the web app is served from a non-drupal directory, but the services are proxied to the drupal service if my endpoint is in the url:

<VirtualHost *:80>

        ServerName mydomain.mobi
        ServerAdmin admin@mydomain.com

        ServerAlias www.mydomain.mobi
        ServerAlias m.mydomain.com
        ServerAlias mobile.mydomain.com

        RewriteEngine On
        RewriteCond %{HTTP_HOST}  !^mydomain.mobi [nocase]
        RewriteRule ^(.*)$        http://mydomain.mobi$1 [L,R=301,E=nocache:1]

        ProxyRequests off
        <Proxy>
            Order deny,allow
            Allow from all
        </Proxy>

        <Location /appsvc/>
                ProxyPass         http://mydomain.com/appsvc/ retry=1 timeout=10 Keepalive=On
                ProxyPassReverse  http://mydomain.mobi/appsvc/
        </Location>
        <Location /services/>
                ProxyPass         http://mydomain.com/services/ retry=1 timeout=10 Keepalive=On
                ProxyPassReverse  http://mydomain.mobi/services/
        </Location>

        ErrorLog /var/log/apache2/mydomain.mobi-error.log
        LogLevel debug

        CustomLog /var/log/apache2/mydomain.mobi-access.log combined

        DocumentRoot /var/mydomain/public_html
        <Directory  "/var/mydomain/public_html">

                AllowOverride None
                Order deny,allow
                Deny from all
                Allow from 192.168.1.0/255.255.255.0

                Options Indexes FollowSymLinks

        </Directory>

</VirtualHost>
jbeuckm’s picture

jbeuckm commented

I'm also getting 406 on logout right after register. It works directly after login.

sk2013’s picture

sk2013 commented

Does anyone find a way to solve this issue?

Thanks

zik.uralov’s picture

zik.uralov commented

I am getting 401 (Unauthorized: CSRF validation failed) by logout. Any suggestion please.

appaulmac’s picture

appaulmac commented

I'm also experiencing the same issue on logout using jQuery (jQuery Mobile) and an ajax call. I'm using ajax for login, node create, node update, all working fine with Services 3.5 and CSRF Token (it took a bit to get to this stage!) but try as I might, I cannot resolve the logout Unauthorized: CSRF validation failed error :(

yonghan’s picture

yonghan commented

hi,ihave tried this script to logout by adding token to header.hope it helps and works as you need.:)

dashboard.js

sercandemir’s picture

sercandemir commented

When you login session_name, sessid and token returns.

CURL parameters are :

curl_setopt($curl, CURLOPT_HTTPHEADER, array('Content-Type: application/json', "X-CSRF-Token: ".$token));
curl_setopt($curl, CURLOPT_COOKIE, "$session_name."=".$sessid");