HTTP status to return after trying to logout without being logged in

user_1062212 0
Viewed 18687

Suppose I have a RESTful authentication endpoint:

http://example.com/api/v1/auth

  • A POST request with email and password allows for logging in. A request gets countered with a response with HTTP 200 for correct login or 403 for incorrect.
  • A DELETE request allows for logging out.

It's obvious that after a successfuly logout I should return HTTP 200. What HTTP response code should I return, if a user tries to logout without being logged in?

status rest http
2 Answers

The short answer to your question is 404. Here's why: DELETE means "delete the resource identified by the URL," so a successful request to DELETE /api/v1/auth should delete whatever /api/v1/auth identifies, causing subsequent requests to DELETE /api/v1/auth to return 404 Not Found.

The problem with DELETE is that, ideally, /api/v1/auth, like any other URL, should represent the same resource regardless of whether the current user is logged in or not and regardless of the identity of the logged-in user; so if one user asks the server to DELETE this resource and receives a 2xx response, any subsequent request, by any user, to POST /api/v1/auth (logging in) or DELETE /api/v1/auth (logging out) should fail and return 404.

Therefore I think it's better to implement both login and logout by POSTing to two different resources, e.g. /api/v1/auth/login and /api/v1/auth/logout.

user_8408190
Related