Log out of user seems not to work.

Can you clarify - you got a session cookie after logging? How did you get the JWT?

I use Vue3 as a JS Frontend. I save the JWT in the local browser storage. For neat relogin on return. The classic Session Cookie is not present. The JWT Token is. Therefore I do have the JWT Token while logged in.

I have no idea if that answered your question. As auth, we use the BEARER on each request.

I hope I can correctly describe my problem with Postman images.

The question about the session cookie makes me curious. Why is that needed? Should it be not enough to send the JWT token as Bearer with any request? THe thing is the vue3 SPA Website works flawlessly in terms of requests ONLY the logout does not work.

If you follow the screenshots by timestamp you'll see why I get the

{
    "message": "'csrf_token' URL query argument is invalid."
}

message.

I did digged deeper and want to clarify something. Our frontend is a Vue3 frontend on localhost:3000. The backend however was on a domain like foobar.local. That means, that Drupal had send the session cookie with the domain: ".foobar.local". Vite, the server while developing has forwarded that cookie to the browser via proxy. With that in mind, the Drupal session cookie was never accepted by the browser because of the different domains. After hours of research I found that Vite has settings that the proxy can rewrite the cookie domains to for example localhost. With that in place the logout works because the session cookie is accpeted and will be used in the logout process.

BUT for whatever reason it still does not work in staging or production environments were the Drupal session domain settings is set to ".foobar.com" and both frontend and backend are on different subdomains. No idea why, but there ist still a problem.

However, I still don't understand why a session cookie is important, IF a JWT cookie authenticates the user to drupal.

I think this was documented in the steps to reproduce in 📌 Manage user session with jwt Needs review so proposing to close as duplicate. I'm setting to Needs review rather than being bold and closing as duplicate.

Seems the same problem or at least related. You may close it.

Closing as duplicate.