rest_framework.urls doesn't work with LogoutView in Django 5.0

[gaurovsoni]

In Django 5.0, GET request for logout was removed (only POST supported now) and it seems like in DRF we still do GET request to the endpoint.

https://docs.djangoproject.com/en/5.0/releases/5.0/

• Support for logging out via GET requests in the django.contrib.auth.views.LogoutView and django.contrib.auth.views.logout_then_login() is removed.

[auvipy]

can you share the traceback as well please?

[meaniebeanie22]

Is there any way to bypass this in the mean time? I updated my django version to 5.0 and as such can't find a way to logout

[Scorpil]

@meaniebeanie22

As a workaround until this gets fixed, I added logout view manually:

class LogoutView(APIView):
    """
    Djano 5 does not have GET logout route anymore, so Django Rest Framework UI can't log out.
    This is a workaround until Django Rest Framework implements POST logout.
    Details: https://github.com/encode/django-rest-framework/issues/9206
    """
    permission_classes = [permissions.IsAuthenticated]

    def get(self, request):
        logout(request)
        return redirect('/')

then in urls.py add it to urlpatterns:

path('api-auth/logout/', LogoutView.as_view(), name='logout'),

[MichaelGatesDev]

@meaniebeanie22

As a workaround until this gets fixed, I added logout view manually:

class LogoutView(APIView):
    """
    Djano 5 does not have GET logout route anymore, so Django Rest Framework UI can't log out.
    This is a workaround until Django Rest Framework implements POST logout.
    Details: https://github.com/encode/django-rest-framework/issues/9206
    """
    permission_classes = [permissions.IsAuthenticated]

    def get(self, request):
        logout(request)
        return redirect('/')

then in urls.py add it to urlpatterns:

path('api-auth/logout/', LogoutView.as_view(), name='logout'),

As a side-note to this fix, make sure you put the url pattern before you include rest_framework.urls (if you are doing so) otherwise it will not work.

e.g.

urlpatterns = [
    # path('api/', views.ApiView.as_view()),
    path('api/', include(router.urls)),
    path('api/auth/logout/', LogoutView.as_view(), name='logout'), 
    path('api/auth/', include('rest_framework.urls')),

[auvipy]

should we need some documentation updated?

[gaurovsoni]

Workaround:

from django.contrib.auth.views import LogoutView

class PatchLogoutView(LogoutView):
    http_method_names = ["get", "post", "options"]

    def get(self, request, *args, **kwargs):
        return self.post(request, *args, **kwargs)

Then on urls

path("api-auth/logout/", PatchLogoutView.as_view(), name="logout"),
path("api-auth/", include("rest_framework.urls", namespace="rest_framework")),

[auvipy]

anyone up for contribution?

[TGoddessana]

hello. What can I do? I'd like to contribute.

Can I just modify the view corresponding to the api-auth url? It looks like already implemented in main branch. @auvipy

[auvipy]

If it is already implemented in main branch then what should we need to change actually?

[gaurovsoni]

If it is already implemented in main branch then what should we need to change actually?

I don't think there is a need to change anything now. since it's already merged #9208 . Just waiting for official djangorestframework package update.

[auvipy]

thanks.

[joeisone]

Hi can someone please help? Logout page is still not working

url:
from django.contrib import admin
from django.urls import path,include
from .views import Index,SignUpView,PatchLogoutView
from django.contrib.auth import views as auth_views
from rest_framework import routers, serializers, viewsets

urlpatterns = [
path('',Index.as_view(),name='index'),
path('signup/',SignUpView.as_view(),name='signup'),
path('login/', auth_views.LoginView.as_view(template_name='inventory/login.html'),name='login'),
path("api-auth/logout/", PatchLogoutView.as_view(), name='logout'),
path('api-auth/', include('rest_framework.urls',namespace="rest_framework")),

views:
class PatchLogoutView(LogoutView):
http_method_names = ["get", "post", "options"]
def get(self, request, *args, **kwargs):
return self.post(request, *args, **kwargs)