title: React and Rails Devise Signout Not Working
body: <p>I am using React + Rails for a web-app, and am using Devise for users authentication. I am struggling with getting a custom Logout button to work.</p>
  
  <p>In my routes.rb I have the following:</p>
  
  <pre><code>devise_for :users do
    delete '/users/sign_out' =&gt; 'devise/sessions#destroy' #I've also tried get instead of delete
  end
  </code></pre>
  
  <p>My devise.rb is configured as follows:</p>
  
  <pre><code>config.sign_out_via = :delete
  </code></pre>
  
  <p>In my (React) JS .jsx file, I have the following logout function, called when the button is clicked.</p>
  
  <pre><code>function logout() {
      fetch("/users/sign_out", {method: 'delete'}).then((response) =&gt; { #I have also tried replacing delete with get
     }).then((result) =&gt; {
       window.location.href = '/';
     });
  }
  </code></pre>
  
  <p>When I use fetch + delete, I get get a 422 error from the fetch; when I use fetch + get, I get a 404 error from the fetch. I've experimented with the various possible permutations of get/delete across the routes/devise.rb files and the .jsx file with no luck.</p>
  
  <p>Specifically, from my rails console I see the following for the 422 error:</p>
  
  <pre><code>Can't verify CSRF token authenticity. Completed 422 Unprocessable Entity in 4ms (ActiveRecord: 0.5ms) 
  </code></pre>
  
  <p>My application controller has the following:</p>
  
  <pre><code>class ApplicationController &lt; ActionController::Base
      protect_from_forgery with: :exception
      before_action :authenticate_user!
  end 
  </code></pre>
  
  <p>Interestingly, if I make it:</p>
  
  <pre><code>class ApplicationController &lt; ActionController::Base
      protect_from_forgery with: :exception
      protect_from_forgery prepend: true
      before_action :authenticate_user!
  end 
  </code></pre>
  
  <p>Then the 422 error goes away (but the application still acts as if the user is logged in). </p>