So I know the logout_token is generated along with the csfr_token during the POST to /user/login?_format=json.

You can get a copy of the csfr_token for the session at any time by calling a GET on /session/token. Is there a way to get the logout token outside of the user logging in? So is there a path that once logged in will provide you with the logout_token? I'm looking for a way to clear a cookie that gets stored beyond the initial session.

1 Answer 1


It appears this does not currently exist. I just created a patch for core. Please review it and make suggestions if you have a chance. https://www.drupal.org/project/drupal/issues/3004421

I will edit this answer if any progress is made with the patch.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.