While working with a gem called devise-jwt, i noticed that an unauthenticated request to DELETE /users/sign_out returns a 204 No-Content.

The same as an authenticated request, whereas an unauthenticated one should return something like 401 Unauthorized.

You can see the issue in detail here waiting-for-dev/devise-jwt#71

Tracking down the problem, it turned out that this problem is actually coming from devise, a plain devise app returns a 204 on an unauthorized request too.

You can try this out with sending a simple DELETE /users/sign_out to a plain devise app without providing a session cookie.

Additionally while testing that, i recognized that if you have a http_basic_authenticate_with in your ApplicationController it returns a 204 too, while it actually should be intercepted before by the basic_auth, or not? This wasn't an error on my side because maybe the basic_auth was still authenticated by an earlier request. Tried it on a GET request before too and got a 401 and a basic_auth message. After that rejected request i directly tried the DELETE again and it returned a 204 again.

I'm not sure what caused this behaviour of the http_basic_authenticate_with, maybe it's actually a bug in rails? Not sure if i should open an issue there right now too.

@rafaelfranca since you're in the rails team and contribute a lot to devise, do you maybe have an idea?

Thanks!