Skip to main content

User Logout

Ory Kratos supports two logout flows:

  • Browser-based (easy): This flow works for all applications running on top of a browser. Websites, single-page apps, Cordova/Ionic, and so on.
  • API-based (advanced): This flow works for native applications like iOS (Swift), Android (Java), Microsoft (.NET), React Native, Electron, and others.

Self-Service Logout for Server-Side Browser Applications

To ensure that a logout was indeed intended by the user, Ory Kratos first generates a Logout URL for a given Ory Session Cookie. You can then open the Logout URL in the Browser.

After successful logout, the browser will be redirected either to the return_to query parameter from the initial request URL, or fall back to the default_browser_return_url value set in Ory Kratos' configuration file:

# kratos.yaml
selfservice:
flows:
logout:
after:
default_browser_return_url: http://test.kratos.ory.sh:4000/
import { Configuration, V0alpha1Api } from '@ory/client';
const kratos = new V0alpha1Api(new Configuration({ basePath: 'https://playground.projects.oryapis.com/api/kratos/public/' }));

const route = (req: Request, res: Response) => {
kratos.createSelfServiceLogoutFlowUrlForBrowsers(req.cookies['ory_kratos_session']).then(({data}) => {
.then(({ data }) => {
console.log(data.logout_url) // The logout URL
console.log(data.logout_token) // The logout token

// You can render the logout URL like so:
// <a href="{{data.logout_url}}>Logout</a>

// Or call the logout token:
// kratos.submitSelfServiceLogoutFlow(data.logout_token).then(() => {
// Logged out
// })
})
}

If an error occurs, the browser is redirected to the Error UI.

Self-Service Logout for Client-Side Browser Applications

Similar to Server-Side Browser Applications, Ory Kratos first generates a Logout URL for a given Ory Session Cookie. However, you can simply call the Logout URL using an AJAX request. Ory Kratos returns a 204 No Content response on success or an error otherwise.

The following scripts show you how to do the browser flow based on cURL. Prerequisites are a recent version of cURL and a registered account in Kratos.

Before we start, we need to log in:

# Username/email and password for an existing account
username="myuser@ory.sh"
password="mysecret"

# We use this cookie jar to initiate the login flow
cookieJar=$(mktemp)

# Initialize the flow
flow=$( \
curl -s -H "Accept: application/json" --cookie $cookieJar --cookie-jar $cookieJar \
'https://playground.projects.oryapis.com/api/kratos/public/self-service/login/browser' \
)

# Get the action URL
actionUrl=$(echo $flow | jq -r '.ui.action')

# Get the CSRF Token
csrfToken=$( \
echo $flow | \
jq -r '.ui.nodes[] | select(.attributes.name=="csrf_token") | .attributes.value' \
)

# Complete the login
session=$( \
curl -s --cookie $cookieJar --cookie-jar $cookieJar -X POST \
-H "Accept: application/json" -H "Content-Type: application/json" \
--data '{ "identifier": "'$username'", "password": "'$password'", "method": "password", "csrf_token": "'$csrfToken'" }' \
"$actionUrl" \
)

echo $session | jq

# Check the current user id
curl -s --cookie $cookieJar --cookie-jar $cookieJar -H "Accept: application/json" \
https://playground.projects.oryapis.com/api/kratos/public/sessions/whoami | \
jq -r ".id"

To logout, first get the generated Logout URL then point the Browser to it:

# Get the Logout URL
logoutUrl=$( \
curl -s --cookie $cookieJar --cookie-jar $cookieJar -H "Accept: application/json" \
https://playground.projects.oryapis.com/api/kratos/public/self-service/logout/browser | \
jq -r ".logout_url" \
)

# Complete the logout
curl -s --cookie $cookieJar --cookie-jar $cookieJar "$logoutUrl"

# Check the current user id again. It should be `null` after a succesful logout
curl -s --cookie $cookieJar --cookie-jar $cookieJar -H "Accept: application/json" \
https://playground.projects.oryapis.com/api/kratos/public/sessions/whoami | \
jq -r ".id"

Self-Service Logout for API Clients

API clients (such as native mobile apps) use Ory Session Tokens. To revoke such a token, call the logout API endpoint:

# Set your token here
session_token=8ziz8oCx0dsgXnoJJgElTQ60cNnbohAr

curl -s -v -X DELETE \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
--data '{"session_token": "'$session_token'"}' \
https://playground.projects.oryapis.com/api/kratos/public/self-service/logout/api

> DELETE /self-service/logout/api HTTP/1.1
> Host: 127.0.0.1:4433
> User-Agent: curl/7.64.1
> Accept: application/json
> Content-Type: application/json
> Content-Length: 53

< HTTP/1.1 204 No Content
< Cache-Control: private, no-cache, no-store, must-revalidate
< Vary: Cookie
< Date: Fri, 18 Jun 2021 09:42:04 GMT