Logout Functionality

Logging out is like handing back your visitor badge — Django forgets who you are until you sign in again.

In this page:

The Logout View
A Safe Logout Button
Wiring the Logout URL

The Logout View

logout() clears the user's session data, so request.user becomes AnonymousUser on the next request.

Example: The Logout View

logout(request) only needs the request object — it looks up and clears the active session itself.

markup

from django.contrib.auth import logout
from django.shortcuts import redirect

def logout_view(request):
    logout(request)
    return redirect('login')

{# Django-only code -- models.py/views.py/urls.py/settings.py snippets, or template markup using Django template tags/variables -- can't run standalone via Judge0 or the browser preview, since it needs a real Django project. Only this course's pure-Python examples (example_lang == 'python', no Django imports) are actually runnable, so those still get the button below. #}

A Safe Logout Button

Logging out changes server state, so it should be triggered by a POST form rather than a plain GET link.

Warning: A GET-based logout link can be triggered accidentally by prefetching or crawlers.

Example: A Safe Logout Button

Wrapping logout in a form with csrf_token makes it a proper POST action instead of an unsafe GET link.

markup

<form method="post" action="{% url 'logout' %}">
  {% csrf_token %}
  <button type="submit">Log Out</button>
</form>

Wiring the Logout URL

The logout view needs its own URL so the form above can post to it.

Example: Wiring the Logout URL

Naming it logout lets the template's {% url logout %} tag resolve to /logout/.

markup

from django.urls import path
from . import views

urlpatterns = [
    path('logout/', views.logout_view, name='logout'),
]

Common Mistakes

Using a GET link (<a href>) for logout in modern Django, when logging out should be a POST request for security.
Forgetting to redirect after logout, leaving the user on a page that still assumes they're logged in.
Not checking request.user.is_authenticated before showing a logout button, showing it to already-logged-out users.

Chapter Summary

django.contrib.auth.logout() clears the current session, ending the login.
Modern Django recommends logout via a POST request (e.g. a form with a submit button), not a plain GET link.
Always redirect to another page after logout so the user isn't stuck on a stale view.

🔒

Chapter Quiz — Complete all 12 topics to unlock

0/12 topics done

Complete these topics first:

← Previous Lesson Setting Up a Login View Next Lesson → User Registration Form

Logout Functionality

The Logout View

A Safe Logout Button

Wiring the Logout URL

Chapter Quiz — Complete all 12 topics to unlock

Login to run this code