Log Out in JavaScript

A login lives in two places. The server's session store keeps Ana's user id under her session id, and her browser keeps that session id in the connect.sid cookie. Logging out means forgetting it in both: destroy the session on the server, so the id is worth nothing even to someone who copied it, and clear the cookie in the browser.

The cookie is HttpOnly, so the page's JavaScript can't delete it. The server does: res.clearCookie(name) sends a Set-Cookie for that name with an empty value and an expiry date long past, and the browser drops it. Here is a route, on another path, that forgets a theme cookie:

app.post("/api/theme/reset", (req, res) => {
  res.clearCookie("theme");
  res.status(204).end();
});

204 No Content means it worked and there is nothing to send back: .end() sends the answer with no body. req.session.destroy(callback) removes the session from the store and then calls your function, so you answer inside that function, once the session is gone. A route that never calls res never answers, and the page waits.

Your server must answer:

POST /api/logout (with Ana's cookie)  →  204  (no body)
     Set-Cookie: connect.sid=; Path=/; Expires=Thu, 01 Jan 1970 00:00:00 GMT
GET /api/me (with the same cookie, copied before)  →  401  {"error": "Not logged in"}

On the page, the header's given Log out button calls it: "Logged in as ana@example.com" and the button go away, the Sign up and Log in links come back, and after a reload GET /api/me answers 401: the visitor is still logged out.

Your task: in server/app.js, below the /api/me route, add POST /api/logout: destroy the session, then clear the connect.sid cookie and answer 204.

Assignment
Follow the Coding Tutorial to write the logout route, which forgets the login on the server and in the browser.

Hint
Both res lines go inside the arrow function you give to req.session.destroy: clear the cookie first, then answer.