Devise 1.4.1 (27 June 2011) changed the default behavior for sign out requests: https://github.com/plataformatec/devise/commit/adb127bb3e3b334cba903db2c21710e8c41c2b40 Jose Valim explained why: “GET requests should not change the state of the server. When sign out is a GET request, CSRF can be used to sign you out automatically and things that preload links can eventually sign you out by mistake a