title: Log out from Drupal 8 with rest
body: <p>From this <a href="https://www.drupal.org/docs/8/core/modules/rest/javascript-and-drupal-8-restful-web-services" rel="nofollow noreferrer">link</a> looks like logout can be performed sending a post to</p>
  
  <pre><code>http://domain/user/logout?_format=json&amp;token=logout_token
  </code></pre>
  
  <p>where <em>logout_token</em> is the value returned from a previous login (example below)</p>
  
  <pre><code>{
  "current_user": {
      "uid": "65",
      "name": "FooBar"
  },
  "csrf_token": "WDwkGWulI1qBkwDuHtZX8Hakl4X2T7kKIm5kG5StWng",
  "logout_token": "l_6TO3cYldLtOx870LI0cYNUwi0wPNSneUA4eZXcZQk"
  }
  </code></pre>
  
  <p>Straightforward, but I'm stuck with a 403 error.</p>
  
  <p>I set my <strong>rest User resource</strong> as the following:</p>
  
  <pre><code>/user/{user}: GET, PATCH, DELETE
  /entity/user: POST  
  methods: GET, POST
  formats: json
  authentication: basic_auth
  </code></pre>
  
  <p>My Drupal <strong>services.yml</strong> contains:</p>
  
  <pre><code>cors.config:
      enabled: true
      # Specify allowed headers, like 'x-allowed-header'.
      allowedHeaders: ['*']
  
      # Specify allowed request methods, specify ['*'] to allow all possible ones.
      allowedMethods: ['*']
  
      # Configure requests allowed from specific origins.
      allowedOrigins: ['*']
  
      # Sets the Access-Control-Expose-Headers header.
      exposedHeaders: false
  
      # Sets the Access-Control-Max-Age header.
      maxAge: false
  
      # Sets the Access-Control-Allow-Credentials header.
      supportsCredentials: false
  </code></pre>
  
  <p>Even though Drupal and the caller are on two different servers (be and fe are hosted on two physical different servers), there are no issues with the cors.</p>
  
  <p>I tried two simple scripts (php and vue js - they do the same thing) and getting the same result</p>
  
  <p><strong>PHP</strong></p>
  
  <pre><code>$url = 'domain/user/logout?_format=json&amp;token=' . $token;
  
  $curl = curl_init();
  
  curl_setopt($curl, CURLOPT_URL, $url);        
  curl_setopt($curl, CURLOPT_RETURNTRANSFER, true);
  curl_setopt($curl, CURLOPT_POST, 1);
  
  curl_setopt($curl, CURLOPT_HTTPHEADER, array(
      'Content-Type: application/json',
      'Access-Control-Allow-Credentials: true'
      ));
  
  $output = curl_exec($curl);
  $info = curl_getinfo($curl);
  
  $response = [
      'info' =&gt; $info,
      'data' =&gt; json_decode($output, true)
  ];
  
  curl_close($curl);
  
  return $response;
  </code></pre>
  
  <p><strong>Vue JS</strong></p>
  
  <pre><code>import Axios from 'axios'
  
  Vue.prototype.$http = Axios
  
  var URL = 'domain/user/logout?_format=json&amp;token=' + this.logout_token
  
  this.$http.post(URL).then(response =&gt; {
    console.log(response)
  })
  .catch(error =&gt; {
      console.log(error)
  })
  .finally(() =&gt; {
      this.loading = false
  })
  </code></pre>
  
  <p>I tried to fire the post request from postman and it worked but I noticed it creates a cookie.</p>
  
  <p>Anyone solved/understood how it works?</p>