{"action":"created","issue":{"url":"https://api.github.com/repos/strongloop/loopback/issues/1496","labels_url":"https://api.github.com/repos/strongloop/loopback/issues/1496/labels{/name}","comments_url":"https://api.github.com/repos/strongloop/loopback/issues/1496/comments","events_url":"https://api.github.com/repos/strongloop/loopback/issues/1496/events","html_url":"https://github.com/strongloop/loopback/pull/1496","id":92463841,"number":1496,"title":"Add error when token is not provided to User.logout()","user":{"login":"ritch","id":462228,"avatar_url":"https://avatars.githubusercontent.com/u/462228?v=3","gravatar_id":"","url":"https://api.github.com/users/ritch","html_url":"https://github.com/ritch","followers_url":"https://api.github.com/users/ritch/followers","following_url":"https://api.github.com/users/ritch/following{/other_user}","gists_url":"https://api.github.com/users/ritch/gists{/gist_id}","starred_url":"https://api.github.com/users/ritch/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ritch/subscriptions","organizations_url":"https://api.github.com/users/ritch/orgs","repos_url":"https://api.github.com/users/ritch/repos","events_url":"https://api.github.com/users/ritch/events{/privacy}","received_events_url":"https://api.github.com/users/ritch/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/strongloop/loopback/labels/%23review","name":"#review","color":"ededed"}],"state":"open","locked":false,"assignee":{"login":"ritch","id":462228,"avatar_url":"https://avatars.githubusercontent.com/u/462228?v=3","gravatar_id":"","url":"https://api.github.com/users/ritch","html_url":"https://github.com/ritch","followers_url":"https://api.github.com/users/ritch/followers","following_url":"https://api.github.com/users/ritch/following{/other_user}","gists_url":"https://api.github.com/users/ritch/gists{/gist_id}","starred_url":"https://api.github.com/users/ritch/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ritch/subscriptions","organizations_url":"https://api.github.com/users/ritch/orgs","repos_url":"https://api.github.com/users/ritch/repos","events_url":"https://api.github.com/users/ritch/events{/privacy}","received_events_url":"https://api.github.com/users/ritch/received_events","type":"User","site_admin":false},"milestone":null,"comments":4,"created_at":"2015-07-01T19:13:18Z","updated_at":"2015-11-17T18:53:20Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/strongloop/loopback/pulls/1496","html_url":"https://github.com/strongloop/loopback/pull/1496","diff_url":"https://github.com/strongloop/loopback/pull/1496.diff","patch_url":"https://github.com/strongloop/loopback/pull/1496.patch"},"body":"Connect to https://github.com/strongloop/strong-arc/issues/1414\r\n\r\nFix #1669"},"comment":{"url":"https://api.github.com/repos/strongloop/loopback/issues/comments/157469342","html_url":"https://github.com/strongloop/loopback/pull/1496#issuecomment-157469342","issue_url":"https://api.github.com/repos/strongloop/loopback/issues/1496","id":157469342,"user":{"login":"kevintechie","id":10410717,"avatar_url":"https://avatars.githubusercontent.com/u/10410717?v=3","gravatar_id":"","url":"https://api.github.com/users/kevintechie","html_url":"https://github.com/kevintechie","followers_url":"https://api.github.com/users/kevintechie/followers","following_url":"https://api.github.com/users/kevintechie/following{/other_user}","gists_url":"https://api.github.com/users/kevintechie/gists{/gist_id}","starred_url":"https://api.github.com/users/kevintechie/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kevintechie/subscriptions","organizations_url":"https://api.github.com/users/kevintechie/orgs","repos_url":"https://api.github.com/users/kevintechie/repos","events_url":"https://api.github.com/users/kevintechie/events{/privacy}","received_events_url":"https://api.github.com/users/kevintechie/received_events","type":"User","site_admin":false},"created_at":"2015-11-17T18:53:19Z","updated_at":"2015-11-17T18:53:19Z","body":"According to the HTTP 1.1 RFC, if the Authorization header is missing, the response must be 401 Unauthorized and respond with an appropriate WWW-Authenticate header. If the Authorization header is  rejected (i. e. the access token is not found in the database), the response must also be 401.\r\n\r\nLoopback returns a 401 for other REST requests that require authorization if the Authorization header is missing. It should return 401 for user/logout as well. Loopback does not respond with a WWW-Authenticate header as required, however.\r\n\r\nLoopback also returns a 401 for other REST requests if the Authorization header is invalid. It should also return 401 for user/logout if the Authorization header is invalid.\r\n\r\nAccording to the RFC, the response can include diagnostic information as to why the Authorization was rejected: http://www.w3.org/Protocols/rfc2616/rfc2616-sec10.html#sec10.4.2 Perhaps Loopback should as well -- similar to how Oauth 2.0 Bearer tokens are implemented."}}