I can log in, perfectly fine, but can't get logout to give me a JSON response. Currently, I can only do POST to


and that would log out, even though the token 123 is not the same as the given csrf-token at login or the logout token. This doesn't work without the token query, even though cookie/session isn't enabled anywhere

("message": "'csrf_token' URL query argument is missing.").

The logout happens when hitting a 403 forbidden on that URL.

Other info: csrf_token=123 is the actual query, doesn't need to be csrf-token or the log out token is given at login Version: 8.5.3 The only basic_auth turned ON, at all endpoints.

1 Answer 1


The mistake is in the url parameters, it should be :


The _format is not needed for logout. I found the parameter name for the token on this page https://api.drupal.org/api/drupal/core%21lib%21Drupal%21Core%21Access%21CsrfAccessCheck.php/function/CsrfAccessCheck%3A%3Aaccess/8.3.x

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.