Logout example in docs when using cookies (refs #12)

Author: vimalloc

examples/csrf_protection_with_cookies.py

@@ -3,8 +3,7 @@
 from flask_jwt_extended import JWTManager, jwt_required, \
     create_access_token, jwt_refresh_token_required, \
     create_refresh_token, get_jwt_identity, set_access_cookies, \
-    set_refresh_cookies
-
+    set_refresh_cookies, unset_jwt_cookies
 
 app = Flask(__name__)
 app.secret_key = 'super-secret'  # Change this!
@@ -73,6 +72,19 @@ def refresh():
     return resp, 200
 
 
+# Because the JWTs are stored in an httponly cookie now, we cannot
+# log the user out by simply deleting the cookie in the frontend.
+# We need the backend to send us a response to delete the cookies
+# in order to logout. unset_jwt_cookies is a helper function to
+# do just that.
+@app.route('/token/remove', methods=['POST'])
+@jwt_required
+def logout():
+    resp = jsonify({'logout': True})
+    unset_jwt_cookies(resp)
+    return resp, 200
+
+
 @app.route('/api/example', methods=['GET'])
 @jwt_required
 def protected():

examples/jwt_in_cookie.py

@@ -3,7 +3,7 @@
 from flask_jwt_extended import JWTManager, jwt_required, \
     create_access_token,  jwt_refresh_token_required, \
     create_refresh_token, get_jwt_identity, set_access_cookies, \
-    set_refresh_cookies
+    set_refresh_cookies, unset_jwt_cookies
 
 # NOTE: This is just a basic example of how to enable cookies. This is
 #       vulnerable to CSRF attacks, and should not be used as is. See
@@ -66,6 +66,19 @@ def refresh():
     return resp, 200
 
 
+# Because the JWTs are stored in an httponly cookie now, we cannot
+# log the user out by simply deleting the cookie in the frontend.
+# We need the backend to send us a response to delete the cookies
+# in order to logout. unset_jwt_cookies is a helper function to
+# do just that.
+@app.route('/token/remove', methods=['POST'])
+@jwt_required
+def logout():
+    resp = jsonify({'logout': True})
+    unset_jwt_cookies(resp)
+    return resp, 200
+
+
 # We do not need to make any changes to our protected endpoints. They
 # will all still function the exact same as they do when sending the
 # JWT in via a header instead of a cookie