How do i programmatically logout user?[Django]
<p>I know to logout user in Django. If i want to logout user, i would do</p>

<pre><code>from django.contrib.auth import logout

def logout_view(request):
    logout(request)
</code></pre>

<p>But what is the relevant way of logging out the user if i am using django oauth toolkit(DOT)? </p>

<p>Should i follow the same or delete the token? Some says delete the token and some says expiry period should be expired. Please provide me the best possible resolution for logging out in DRF using DOT.</p>

<p>You can check <a href="https://django-oauth-toolkit.readthedocs.io/en/latest/tutorial/tutorial_04.html" rel="nofollow">Revoking an OAuth2 Token</a></p>

<blockquote>
  <p>Youâve granted a user an Access Token, following part 1 and now you would like to revoke that token, probably in response to a client request (to logout).</p>
</blockquote>

<p>And <a href="https://stackoverflow.com/questions/24666124/do-you-logout-a-user-who-login-via-oauth2-by-expiring-their-access-token">Do you logout a user who login via OAuth2 by expiring their Access Token?</a></p>

<h3>EDIT</h3>

<pre><code># OAuth2 provider endpoints
oauth2_endpoint_views = [
    url(r'^authorize/$', oauth2_views.AuthorizationView.as_view(), name="authorize"),
    url(r'^token/$', oauth2_views.TokenView.as_view(), name="token"),
    url(r'^revoke-token/$', oauth2_views.RevokeTokenView.as_view(), name="revoke-token"),
]
</code></pre>

<p>If you follow the tutorial part2 you will find you already have the revoke-token url, so you just need to send request to this url.</p>

<h3>EDIT2</h3>

<p>Let me try to explain this clearly</p>

<p>When you use Django OAuth Toolkit and DRF, you usually will use </p>

<pre><code>REST_FRAMEWORK = {
    'DEFAULT_AUTHENTICATION_CLASSES': (
        'oauth2_provider.ext.rest_framework.OAuth2Authentication',
    )
}
</code></pre>

<p>And you can get access token by</p>

<pre><code>curl -X POST -d "grant_type=password&amp;username=&lt;user_name&gt;&amp;password=&lt;password&gt;" -u"&lt;client_id&gt;:&lt;client_secret&gt;" http://localhost:8000/o/token/
</code></pre>

<p>And get response like this</p>

<pre><code>{
    "access_token": "&lt;your_access_token&gt;",
    "token_type": "Bearer",
    "expires_in": 36000,
    "refresh_token": "&lt;your_refresh_token&gt;",
    "scope": "read write groups"
}
</code></pre>

<p>Now you can use your access_token to request the api you set like this</p>

<pre><code>curl -H "Authorization: Bearer &lt;your_access_token&gt;" http://localhost:8000/users/1/
</code></pre>

<p><strong>How to logout depends on how you define login</strong></p>

<p>Website define login from the session in cookies. When you developing a mobile app, You will define login depend on message in your app (<a href="https://stackoverflow.com/questions/10295504/ios-how-to-authenticate-a-user-after-login-for-auto-login">user credentials present in keychain or not</a> when it comes to IOS), and that is what your code do:</p>

<pre><code>from django.contrib.auth import logout

def logout_view(request):
    logout(request)
</code></pre>

<p>You can see source code here <a href="https://github.com/django/django/blob/7549eb000430192833f05186056d1ae20b0d17ad/django/contrib/auth/__init__.py#L133" rel="nofollow">django-logout</a> and docs <a href="https://docs.djangoproject.com/en/1.10/topics/http/sessions/#django.contrib.sessions.backends.base.SessionBase.flush" rel="nofollow">here</a></p>

<blockquote>
  <p>flush()</p>
  
  <p>Deletes the current session data from the session and deletes the session cookie. This is used if you want to ensure that the previous session data canât be accessed again from the userâs browser (for example, the django.contrib.auth.logout() function calls it).</p>
</blockquote>

<p>But remember, From <a href="https://stackoverflow.com/questions/22557044/delete-access-token-after-logout">Luke Taylor</a></p>

<blockquote>
  <p>The lifetime of the access_token is independent of the login session of a user who grants access to a client. OAuth2 has no concept of a user login or logout, or a session, so the fact that you expect a logout to revoke a token, would seem to indicate that you're misunderstanding how OAuth2 works. You should probably clarify in your question why you want things to work this way and why you need OAuth.</p>
</blockquote>

<p>Finally In your case, I think you need to revoeke the token before logout:</p>

<pre><code>def revoke-token(request):
    # just make a request here
    # POST /o/revoke_token/ HTTP/1.1 Content-Type: application/x-www-form-urlencoded token=XXXX&amp;client_id=XXXX&amp;client_secret=XXXX


def logout(request):
    response = revoke-toke(request)
    # if succeed
    logout(request)
</code></pre>

python django python-3.x oauth django-rest-framework