v0.1.72 — 14 May 2026
Bug Fix — Logout now properly invalidates Bearer token sessions
Affected endpoint: POST /api/auth/logout
Who is affected: Any API client that authenticates with a Bearer token from
POST /api/auth/login and relies on logout to revoke access.
What was wrong
Calling POST /api/auth/logout with a Bearer token had no effect. The token
stayed fully usable — requests to GET /api/auth/user, GET /api/roles, and
all other protected endpoints returned 200 after logout as if the logout
never happened.
What changed
The session is now revoked server-side immediately. After a successful logout, the token is rejected across all endpoints — even before its natural JWT expiry time.
Action required for API clients
You must include the access token in the Authorization header when calling
logout. Without it the server has no session to revoke.
POST /api/auth/logout
Authorization: Bearer <access_token>Before / After
| Scenario | Before this fix | After this fix |
|---|---|---|
GET /api/auth/user after logout (Bearer) | ✅ 200 — token still worked | ❌ 401 — token rejected |
GET /api/roles after logout (Bearer) | ✅ 200 — token still worked | ❌ 401 — token rejected |
| Browser session logout | ✅ Worked (cookie cleared) | ✅ Still works (+ all sessions revoked globally) |
Logout without Authorization header | ✅ Returned 200 | ✅ Still returns 200 (cookie fallback) |
Upgrade notes
No schema migrations or configuration changes are needed. The only change
required in your client code is to include the Authorization header on logout
requests if you are using Bearer token authentication.
// Before — logout without a token header (broken for Bearer clients)
await fetch('/api/auth/logout', { method: 'POST' })
// After — pass the token so the session is revoked server-side
await fetch('/api/auth/logout', {
method: 'POST',
headers: { Authorization: `Bearer ${accessToken}` },
})