I have a small app I'm working on and after I created a new build I'm unable to login or logout. This seems to happen because drupal thinks I'm logged in but my app doesn't have the user details in local storage. So I don't know the logout_token needed to logout from app.

Is there a way I can fix this?

  • Why can't you login again to get a new session/tokens? Does your Drupal configuration prevent multiple sessions with the same UID?
    – Shawn Conn
    Apr 3, 2018 at 17:29
  • 1
    Been a while but I'm assuming that they were running into the same problem I do when using REST with cookies. Attempts to re-login aren't possible when a session cookie already exists; Drupal rejects attempts to do so. Feb 21, 2019 at 21:25

2 Answers 2



When you login using rest api, csrf and logout tokens are generated. use the logout_token generated to logout form your app. Make a post request to


Sample code to logout from your app will be similar to

 var xhr = new XMLHttpRequest();
 xhr.withCredentials = true;

 xhr.addEventListener("readystatechange", function () {
   if (this.readyState === 4) {

 xhr.open("POST", "http://example.com/user/logout?_format=json&token=logout_token");
 xhr.setRequestHeader("content-type", "application/json");


Hope that helps.



If you are using cookie based login you can go into the Application tab then on the left hand side Cookies > your-site-name in the dev console and delete the cookie that starts with SESS. This will log you out. To the best of my knowledge there isn't a way to request a logout_token after it is initially created during /user/login. So in your case if you still have an active session (using cookies) you are sort of stuck. I just submitted a patch for review in core which addresses this. I'd kindly ask that review it and make suggestions if you have a chance. https://www.drupal.org/project/drupal/issues/3004421

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.