User Logout Token

## Project

User Logout Token
https://www.drupal.org/project/logout_token

## Description

This module provides a simple REST endpoint (/session/logout/token)
that allows developers to retrieve the CSRF logout token during
active user sessions.

In Drupal core, the logout token is only provided during the
initial login response. If a user resets their password, the
logout token gets regenerated, making it impossible to perform
a proper logout via REST. This module solves that by providing
a dedicated endpoint to fetch the current logout token at any
time during the session.

The module is useful for decoupled/headless Drupal architectures
where frontend applications need to handle secure logout operations.

## How it differs from similar projects

- No similar module exists on drupal.org that provides this
specific functionality
- Solves a known limitation in Drupal core's REST logout flow

## Security considerations

- Endpoint is protected by Drupal core's _user_is_logged_in
access check; anonymous users cannot access it
- Uses Drupal core's CsrfTokenGenerator service for token
generation (same as core's login controller)
- Uses Drupal core's RouteProviderInterface to resolve the
logout route path
- No direct database queries
- No raw user input processing
- No file operations, no external HTTP requests
- No use of eval(), unserialize(), or other risky functions
- Minimal codebase: single controller with proper dependency
injection

## Other projects maintained

- Views REST Export Field Grouping:
https://www.drupal.org/project/views_rest_field_grouping