sign out a user when using API

[a14m]

this is also reported on http://stackoverflow.com/questions/27804349/simple-token-authentication-signout-for-rails-json-api
here is my session controller

class SessionsController < Devise::SessionsController  
  respond_to :json
  skip_filter :verify_signed_out_user, only: :destroy

  def create
    self.resource = warden.authenticate!(scope: resource_name)
    render :create, status: :created
  end

  def destroy
    current_user.authentication_token = nil
    super
  end
end  

the problem is if an invalid request it's still hit this and cause the user to log out although the request should not sign out the user

to be extra clear here are my specs

  describe 'DELETE sessions#destroy' do
    let(:user) { Fabricate(:confirmed_user) }
    describe 'with request headers' do
      context 'valid credentials' do
        it 'Returns 204' do
          delete '/users/sign_out', {}, {
            HTTP_CONTENT_TYPE: 'application/json',
            HTTP_ACCEPT: "application/vnd.app+json; version=1",
            "X-User-Email" => user.email,
            "X-User-Token" => user.authentication_token
          }

          user.reload
          expect(response.status).to eq 204
          expect(user.authentication_token).not_to eq @auth_token
          #^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ this is ok cause it's the valid user
        end
      end

      context 'invalid credentials' do
        it 'Returns 204' do
          delete '/users/sign_out', {}, {
            HTTP_CONTENT_TYPE: 'application/json',
            HTTP_ACCEPT: "application/vnd.app+json; version=1",
            "X-User-Email" => user.email,
            "X-User-Token" => 'Invalid'
          }

          user.reload
          expect(response.status).to eq 204
          expect(user.authentication_token).to eq @auth_token
          #^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ this is weird 
          # why did the user get new auth token when didn't sign out ????
        end
      end
    end

[gonzalo-bulnes]

Hi @artmees,

A few questions to precise the context:

• does your SessionsController act as a token authentication handler?
• if it does, is the optional fallback to Devise disabled?
• is the authentication token configured to act as a sign_in_token?

Also, in the specs you wrote, how is defined @auth_token?

[a14m]

I cannot verify this or answer the questions cause in that project I'm now using JWT. and it's a messy git history to track this down, sorry 😞