You are presented with a session_token, csrf_token, and logout_token during a rest request to /user/login. You can always obtain a new copy of the csrf_token from the path /session/token. You however cannot request a new copy of the logout_token to the best of my knowledge. I propose that we make an endpoint available at /session/logouttoken where you can request a copy of this token after its initial point of creation.

This is my first time reporting an issue/creating a patch for core. Hopefully I didn't mess this process up horribly!

CommentFileSizeAuthor
#15 interdiff_13-14.txt502 bytesadityasingh
#14 interdiff_13-14.patch502 bytesadityasingh
#14 3004421-14.patch1.85 KBadityasingh
#13 3004421-13-7-interdiff.txt502 bytesmbovan
#13 3004421-13.patch1.85 KBmbovan
#7 logouttoken-3004421-6.patch1.85 KBkatzilla
#6 logouttoken-3004421-6.patch.txt1.85 KBkatzilla
#4 logouttoken-3004421-4.patch1.83 KBkatzilla
#2 logouttoken-3004421-1.patch1.83 KBshawnmatthews
logouttoken.patch1.85 KBshawnmatthews

Comments

shawnmatthews created an issue. See original summary.

shawnmatthews’s picture

shawnmatthews commented
StatusFileSize
new logouttoken-3004421-1.patch1.83 KB

Re-roll after reading - https://www.drupal.org/node/1319154

Version: 8.7.x-dev » 8.8.x-dev

Drupal 8.7.0-alpha1 will be released the week of March 11, 2019, which means new developments and disruptive changes should now be targeted against the 8.8.x-dev branch. For more information see the Drupal 8 minor version schedule and the Allowed changes during the Drupal 8 release cycle.

katzilla’s picture

katzilla
she/her
Primary language German
Location Göttingen, Germany
commented
StatusFileSize
new logouttoken-3004421-4.patch1.83 KB

Hi @shawnmatthews. Thanks for your patch - exactly what I needed for my project :) The patch did not apply against 8.6.13 because of some missing Quotes in the .yml File. Also, this should be a GET and not a POST request, because we are not sending over any data. Attached a new patch.

Version: 8.8.x-dev » 8.9.x-dev

Drupal 8.8.0-alpha1 will be released the week of October 14th, 2019, which means new developments and disruptive changes should now be targeted against the 8.9.x-dev branch. (Any changes to 8.9.x will also be committed to 9.0.x in preparation for Drupal 9’s release, but some changes like significant feature additions will be deferred to 9.1.x.). For more information see the Drupal 8 and 9 minor version schedule and the Allowed changes during the Drupal 8 and 9 release cycles.

katzilla’s picture

katzilla
she/her
Primary language German
Location Göttingen, Germany
commented
StatusFileSize
new logouttoken-3004421-6.patch.txt1.85 KB

new patch for d8.9

katzilla’s picture

katzilla
she/her
Primary language German
Location Göttingen, Germany
commented
StatusFileSize
new logouttoken-3004421-6.patch1.85 KB

wrong filename ;)

katzilla’s picture

katzilla
she/her
Primary language German
Location Göttingen, Germany
commented
Issue tags: +ContributionWeekend2020

Version: 8.9.x-dev » 9.1.x-dev

Drupal 8.9.0-beta1 was released on March 20, 2020. 8.9.x is the final, long-term support (LTS) minor release of Drupal 8, which means new developments and disruptive changes should now be targeted against the 9.1.x-dev branch. For more information see the Drupal 8 and 9 minor version schedule and the Allowed changes during the Drupal 8 and 9 release cycles.

inders’s picture

inders commented

+1 for this issue.

As of now, I am exposing this manually inside one of rest resource plugin. logout_token is needed for avoiding 403 errors in case of App. I was loosing my local session storage sometime but it was logged in at server. So was never able to login again inside App. I had to manually expose it from rest resource and use it inside Vue App. While doing error handling , it was easy to get this token and logging out from App.

  $logout_path = \Drupal::service('router.route_provider')->getRouteByName('user.logout.http');
  $logout_path = ltrim($logout_path->getPath(), '/');
  $logout_token = \Drupal::service('csrf_token')->get($logout_path);

Thank you!

Version: 9.1.x-dev » 9.2.x-dev

Drupal 9.1.0-alpha1 will be released the week of October 19, 2020, which means new developments and disruptive changes should now be targeted for the 9.2.x-dev branch. For more information see the Drupal 9 minor version schedule and the Allowed changes during the Drupal 9 release cycle.

mbovan’s picture

mbovan commented 
+++ b/core/modules/user/user.routing.yml
@@ -216,3 +216,13 @@ user.well-known.change_password:
+  path: '/session/logouttoken'

Would it make sense to use session/token/logout path instead?

mbovan’s picture

mbovan commented
Issue tags: +ContributionWeekendCH, +ContributionWeekend2021
StatusFileSize
new 3004421-13.patch1.85 KB
new 3004421-13-7-interdiff.txt502 bytes

I addressed #12.

adityasingh’s picture

adityasingh commented
StatusFileSize
new 3004421-14.patch1.85 KB
new interdiff_13-14.patch502 bytes

Fixed coding standards issue.

adityasingh’s picture

adityasingh commented
StatusFileSize
new interdiff_13-14.txt502 bytes

Adding the interdiff.

Version: 9.2.x-dev » 9.3.x-dev

Drupal 9.2.0-alpha1 will be released the week of May 3, 2021, which means new developments and disruptive changes should now be targeted for the 9.3.x-dev branch. For more information see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.

sadikyalcin’s picture

sadikyalcin commented

I'm keep getting access denied / This route can only be accessed by authenticated users after upgrading to 9.x. Any pointers on what the issue might be? I am definitely logged in.

Version: 9.3.x-dev » 9.4.x-dev

Drupal 9.3.0-rc1 was released on November 26, 2021, which means new developments and disruptive changes should now be targeted for the 9.4.x-dev branch. For more information see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.

Version: 9.4.x-dev » 9.5.x-dev

Drupal 9.4.0-alpha1 was released on May 6, 2022, which means new developments and disruptive changes should now be targeted for the 9.5.x-dev branch. For more information see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.

Version: 9.5.x-dev » 10.1.x-dev

Drupal 9.5.0-beta2 and Drupal 10.0.0-beta2 were released on September 29, 2022, which means new developments and disruptive changes should now be targeted for the 10.1.x-dev branch. For more information see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.

smustgrave’s picture

smustgrave commented
Status: Needs review » Needs work
Issue tags: +Needs Review Queue Initiative, +Needs tests, +Needs change record

This issue is being reviewed by the kind folks in Slack, #needs-review-queue-initiative. We are working to keep the size of Needs Review queue [2700+ issues] to around 400 (1 month or less), following Review a patch or merge request as a guide.

public function logoutToken(Request $request
Should be typehinted

This will need test coverage.
Also will need a change record to announce the new route.

Version: 10.1.x-dev » 11.x-dev

Drupal core is moving towards using a “main” branch. As an interim step, a new 11.x branch has been opened, as Drupal.org infrastructure cannot currently fully support a branch named main. New developments and disruptive changes should now be targeted for the 11.x branch, which currently accepts only minor-version allowed changes. For more information, see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.

tcfunk’s picture

tcfunk commented

Would it make sense to just return the token value as text (similar to the response from /session/token) instead of as a json object?

maxilein’s picture

maxilein commented

In the meantime see: https://www.drupal.org/project/logout_token

Version: 11.x-dev » main

Drupal core is now using the main branch as the primary development branch. New developments and disruptive changes should now be targeted to the main branch.

Read more in the announcement.