Fix for "'csrf_token' URL query argument is invalid" error during logout I am creating a set of API endpoints for a mobile app using Rest. For User authentication, I am using the default API endpoints supplied by Drupal. That would be

/user/logout?_format=json&amp;token=&lt;logout_token obtained from login api response.&gt;


I wanted to remove the _format=json from the URL parameter and so I created a custom route with the existing controller just for this purpose. However, I am getting an error. 

"'csrf_token' URL query argument is invalid


I am not able to figure out how to remove this error. I had added a csrf_token as an additional parameter with the one I got from successful login. It seems however that the csrf token being validated against is generated somewhere else. 

I can remove this error by removing the csrf token entry from the routing file entry but that would be a security violation. How do we fix this error or is there a better way to handle the user logout api endpoint.
You can use POST method on /user/logout without params and token, the cookie will be deleted so the user will be logged out, but in the server-side Drupal will not destroy the session, so you'll end up by having a lot of unused sessions...

I wonder why do you want to remove the _format=json from the URL ?