pub async fn logout() -> Result<impl IntoResponse, (StatusCode, Json<Value>)>Expand description
Logs out the current user by invalidating their session cookie.
Sets the authentication cookie to expire immediately (max_age = -1 hour) which causes
the browser to discard it. This effectively logs the user out without requiring server-side
session invalidation. The cookie no longer contains a valid Claims token.
§Returns
Always returns 200 OK with success message and an expired cookie header
§Security
- HTTP-only cookie prevents client-side manipulation
- SameSite=Lax protects against CSRF
- Setting max_age to negative value causes immediate expiration
§Example Response
{"status": "success", "message": "successfully logged out"}