Back to API Practice

Security API trainer

Session Logout API Practice

Practice testing logout, session invalidation, token revocation, cookie cleanup, device scope, CSRF protection, and safe auth failure handling.

Start writing test ideasTry API sandbox

How to use this trainer

Choose, send, inspect, write, improve

Safe client-side simulator. No real backend is called and no real data is sent.

  1. 1Choose a preset case
  2. 2Send a simulated request
  3. 3Read the response and QA note
  4. 4Write what you would test
  5. 5Check your coverage

Interactive sandbox

Try the API request

Choose logout scope and auth conditions, send a simulated POST /api/auth/logout request, and inspect token, cookie, session, and provider-failure behavior.

Request

Build the logout request

POST/api/auth/logout

Request JSON

application/json
{
  "scope": "current-device",
  "revokeRefreshToken": true,
  "clearCookies": true
}

Test case presets

Choose a case, inspect the fake response, then write what you would test.

Happy path

Token/session state

Security / browser

Reliability

Response

Fake API result

Send a simulated logout request to see status, response JSON, QA note, and session invalidation risks. No real token is sent.

List valid logout, missing/expired tokens, already logged out, refresh-token reuse after logout, logout all devices, CSRF, cookie clearing, protected API checks, logs, outages, retries, and mobile/browser behavior.

Tip: a stronger answer usually mixes happy path, negative cases, state changes, data, backend, UX, accessibility, and risk.

How to structure your answer

Happy pathNegative casesData rulesSecurity/API risksUX/performance
API ReferenceEndpoint, request fields, responses, and business rulesExpand

API reference

Session Logout endpoint

End the current session or all sessions, revoke refresh tokens, clear browser cookies, and fail safely when auth dependencies are unavailable.

Endpoint

POST/api/auth/logout

Purpose

Invalidate a user session and revoke token/cookie auth state.

Request fields

scope: current-device or all-devices

revokeRefreshToken: boolean

clearCookies: boolean

Success response

204 No Content

Request body

{
  "scope": "current-device",
  "revokeRefreshToken": true,
  "clearCookies": true
}

Example success body

{
  "status": "logged_out",
  "sessionId": "sess_current",
  "refreshTokenRevoked": true,
  "cookiesCleared": true
}

Errors

  • 401 missing or invalid token
  • 401 expired or revoked token
  • 403 missing or invalid CSRF token
  • 415 unsupported media type
  • 503 auth provider or session store unavailable

Security notes

  • tokens and session IDs should never be logged
  • logout cannot target another user's session
  • session scope must be tenant/workspace safe
  • browser back button should not expose protected data
  • global logout should create an audit/security event

Business rules

  • valid logout returns 204 No Content
  • missing token returns 401
  • expired token behavior follows product requirements
  • already logged out behavior is idempotent if required
  • refresh tokens cannot be reused after logout
  • logout all devices revokes every active session
  • cookie-based logout clears auth cookies
  • CSRF protection is required for cookie auth
  • protected APIs reject old tokens after logout
  • auth provider and session-store failures fail safely

API interview guide

What this Session Logout API practice covers

This scenario trains logout and session revocation testing where active sessions, device metadata, token invalidation, and idempotent revoke behavior matter.

Key risks covered

  • - List active sessions with safe device metadata and no token exposure.
  • - Revoke one device, revoke all other devices, current-session policy, and duplicate revoke.
  • - Unknown session, malformed session id, missing auth, and another user's session denied.
  • - Access and refresh tokens fail after revoke, including read-after-revoke checks.
  • - CSRF for cookie flows, session-store outage, audit logs, suspicious device signals, and metrics.

Example interview prompt

How would you test APIs for listing sessions, logging out, and revoking one or all other devices?

Common mistakes

  • - Only checking that logout removes the current token.
  • - Forgetting multi-device sessions, duplicate revoke, and another user's session.
  • - Not checking refresh token invalidation, audit logs, CSRF, or session-store failures.
Related practice:Token Refresh APILogin APIMFA Challenge API