Logout Service API Returns 200 but User Session Remains Active

Forum
1

Hi Team,

I have implemented a logout service method which is being called from a component wherever logout functionality is required. However, despite receiving a 200 response from the API, the logout process is not functioning as expected — the user session remains active.

Below is the code for your reference:

Logout Service Method:

 async userLogout() {     
    
     const response = await this.fetchClient.fetch('/user/logout', {
       method: 'POST',
        headers: {
          'Content-Type': 'application/json',
          'Accept': 'application/json'
        },       body: JSON.stringify({}),
     });
     return response.json();
   }

Component Integration:

  this.authService.updateMobileNumber({ phone: phone.number, oid: this.oidNumber })
  .then(response => {
    console.log('Update successful:', response);

    return this.authService.updateUserSettingMobileNumber({ phone: phone.number });
  })
  .then(resp => {
    console.log('User setting updated successfully');

    this.alertService.success('Mobile number updated successfully');
    this.mobileNumber = phone.number;
    this.bsModalRef.hide();
    this.authService.userLogout();
  })
  .catch(error => {
    console.error('Failed to update mobile number or user setting:', error);
    this.alertService.danger('Failed to update mobile number. Please try again.');
  });

Although the logout API is being hit and returns a 200 OK status, the session is not actually terminated. Please advise if there is any additional step required (such as clearing cookies or redirecting to a login page) to complete the logout process effectively.

Let me know if you need further information.

Best regards,

Rahul

2

Hi @rmishra1,

What do you mean by session is not actually terminated and what do you expect to happen?

In case you’ve been logged in via cookie auth, the cookies should have been deleted after the call to /user/logout. Is this not the case? Are you still able to perform requests against the API that require to be logged in?

Depending on the Web SDK version you are using we offer a logout method as part of the SimplifiedAuthService ( Web SDK documentation >=1022) or the LoginService ( Web SDK documentation <1022).

We usually do a page reload after logout to ensure all user data is acutally removed from application state and the user ends up on the login page again.

Regards,
Tristan