{"action":"created","issue":{"url":"https://api.github.com/repos/plataformatec/devise/issues/3605","labels_url":"https://api.github.com/repos/plataformatec/devise/issues/3605/labels{/name}","comments_url":"https://api.github.com/repos/plataformatec/devise/issues/3605/comments","events_url":"https://api.github.com/repos/plataformatec/devise/issues/3605/events","html_url":"https://github.com/plataformatec/devise/issues/3605","id":79861193,"number":3605,"title":"Devise - user session still valid after sign out","user":{"login":"levi-l-damian","id":5083376,"avatar_url":"https://avatars.githubusercontent.com/u/5083376?v=3","gravatar_id":"","url":"https://api.github.com/users/levi-l-damian","html_url":"https://github.com/levi-l-damian","followers_url":"https://api.github.com/users/levi-l-damian/followers","following_url":"https://api.github.com/users/levi-l-damian/following{/other_user}","gists_url":"https://api.github.com/users/levi-l-damian/gists{/gist_id}","starred_url":"https://api.github.com/users/levi-l-damian/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/levi-l-damian/subscriptions","organizations_url":"https://api.github.com/users/levi-l-damian/orgs","repos_url":"https://api.github.com/users/levi-l-damian/repos","events_url":"https://api.github.com/users/levi-l-damian/events{/privacy}","received_events_url":"https://api.github.com/users/levi-l-damian/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2015-05-23T14:25:37Z","updated_at":"2015-05-23T19:44:03Z","closed_at":null,"body":"Here is the scenario: 1. start the app 2. sign in as a user having remember_me = true 3. close the browser 4. restart the browser, user shown as signed in. 5. click on the sign out link. 6. Home or \"/\" page is rendered but user still shown as signed in.\r\n\r\nI checked the heroku logs and the user is found and loaded when GET \"/\" is executed.\r\n\r\nWhat is wrong here? Otherwise the sign out works well if the browser is not closed and restarted. The matter is consistent in dev and prod.\r\n\r\nI have the same question open is stack overflow:\r\nhttp://stackoverflow.com/questions/30382431/devise-user-session-still-valid-after-sign-out\r\n"},"comment":{"url":"https://api.github.com/repos/plataformatec/devise/issues/comments/104938995","html_url":"https://github.com/plataformatec/devise/issues/3605#issuecomment-104938995","issue_url":"https://api.github.com/repos/plataformatec/devise/issues/3605","id":104938995,"user":{"login":"josevalim","id":9582,"avatar_url":"https://avatars.githubusercontent.com/u/9582?v=3","gravatar_id":"","url":"https://api.github.com/users/josevalim","html_url":"https://github.com/josevalim","followers_url":"https://api.github.com/users/josevalim/followers","following_url":"https://api.github.com/users/josevalim/following{/other_user}","gists_url":"https://api.github.com/users/josevalim/gists{/gist_id}","starred_url":"https://api.github.com/users/josevalim/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/josevalim/subscriptions","organizations_url":"https://api.github.com/users/josevalim/orgs","repos_url":"https://api.github.com/users/josevalim/repos","events_url":"https://api.github.com/users/josevalim/events{/privacy}","received_events_url":"https://api.github.com/users/josevalim/received_events","type":"User","site_admin":false},"created_at":"2015-05-23T19:44:03Z","updated_at":"2015-05-23T19:44:03Z","body":"That's a behaviour due to how Rails cross site request forgery protection works. When you close and reopen the browser, the token used for post/put/delete is outdated. So you do a new request (which is not authenticated), we authenticate you along the way and then we see the token is invalid, re-rendering the page. It is not specific to Devise signout but any functionality on the website. "}}