HTTP RESTful Webservice Logout: Which is correct or better practice - POST or DELETE?
<p>As stated by the accepted answer in <a href="https://stackoverflow.com/questions/15098392/which-http-method-should-login-and-logout-actions-use-in-a-restful-setup">Which HTTP method should Login and Logout Actions use in a &quot;RESTful&quot; setup</a> it is recommendable to use HTTP POST (= create) for a login in a RESTful webservice (e.g. <code>/webservice/login/</code>). POST is neither idempotent nor safe (<a href="http://restcookbook.com/HTTP%20Methods/idempotency/" rel="nofollow noreferrer">http://restcookbook.com/HTTP%20Methods/idempotency/</a>).</p>

<p>However how about a logout (e.g. /webservice/logout/). Shall I use POST or DELETE?</p>

<p>DELETE is idempotent - no matter if a session (or whatever) exists on the server or not it is deleted and the answer from the webserver is some OK without any further contents. This feels somehow natural to me.</p>

<p>POST is not idempotent and some posters on similar questions recommend POST for a REST logout. I can think of two possible reasons: </p>

<ol>
<li><p>if the session does not exist the server may return a 404 - an
successful answer otherwise (two kinds of answer)</p></li>
<li><p>a logout may trigger e.g. a database update containing logout
    information for a user etc. and therefore a logout operation would
    not be idempotent</p></li>
</ol>

<p>So which HTTP Method would be better for a logout - POST or DELETE?</p>