Laravel Authentication Tutorial #5 - Logging Users Out

Key Takeaways

all right then gang so in the last lesson we were able to register for a new account and when we did that larel created that new user for us in the users table but also behind the scenes it updated the session ID for us and we see that session cook it right here so now on every subsequent request that we send while we're logged into the application this session cookie gets sent to the server and using that session cookie LEL can identify whether we're authenticated or not currently we are because we just registered and use the login method if we have a log out then Lara will update the session cookie so that it knows that we are not logged in now we're logged in currently because we just registered so I think the next logical step would be to log users back out okay so the first thing we need to do is make a routes and a controller action for the logout request now when we send a logout request it's always a bit more secure to use a post request so I'm just going to copy and paste the login route right here which already uses the post method and then we just need to change the path to forward slash logout we also need to update the control action name as well which is going to be logout and finally we can call this route just log out all right so now let's go and make the logout action in the OR controller so down at the bottom below the login action we're going to make a new public function and that's going to be called logout and then we need a set of curly braces down here as well now we're going to come back to this action and flesh it out later but to begin with I want to create a button in the Navar which is going to trigger this post request to the login uh the logout rather route so let's open up the layout View and just add that in first of all now like I said a moment ago when we click on the button to log out it should be sending a post request to the server to that forward SL logout route and for that to happen we need to place the button inside a form and specify the method to be post so let's do that then let's make a new form tag down here at the end and for the action we're going to use the route function first of all and we're going to direct this towards the logout route we also need a method attribute which we're going to set to be post also I want to just add a Tailwind class to this form to strip out any margin just for stylistic purposes so let's add the M hyphen Zer class to do that all right so inside this form then we need the csrf directive to prevent cross site request forgery and then below that we need a button to submit the form and that's going to trigger the post request to the logout route and I'm going to give that a class of BTN as well just to style it for the text we can just say log out all right so now we have a button in the the nav bar which a user can click to log out and that sends a post request to the logout route which in turn calls the logout action inside the or controller so now then we just need to head to that action inside the controller and actually log the user out so then the first thing we're going to do in here is use the or class like we did before to log in but this time we're going to use the logout method instead to log the user out and this time we don't need to pass a user in as an argument so this function just logs out the current user in a sense that it breaks the connection between the current session and the authenticated user so it removes all user data like the user ID from the current session however it doesn't completely remove all the data from the session only the user data so any other the data in the session will remain for example if you were browsing a shopping website and you had a cart full of products then any products that were stored in the session well they would still remain even after logging out so to completely remove all the data from a session after a log out we can first of all accept a request argument up here which we automatically get access to in the action then we can use that request object and on that use a method called session and then on that session we can tack on another method called invalidate and this invalidate method will remove any other data associated with the session completely so it's often a good practice to do this kind of thing after a user logs out to clear the rest of the session data we're also going to use another session method after this which is recommended to do after you log a user out so let me just copy this down onto the next line as well and then we're going to replace the invalidate method with one called regenerate token so what this does is regenerate the csrf token for the next session and it means any forms which get submitted with the previous old token from the previous session they're just going to be flat out rejected so this is just an added layer of security and it's generally recommended that we do this after we log a user out you don't have to do both of these things but I wanted to mention them because it is a good practice in a lot of cases okay so now finally we want to redirect the user once they've logged out back to the login page so let's return a redirect here then tack on the route method and then as an argument to that we'll use the show. login route name to redirect back to the login view once you user logs out all right so now let's save this and we can see if this all works in the browser all right so I'm currently still authenticated from the previous lesson where we registered and logged the user in now I'm going to log out and if this works it should redirect me then back to the login page so let's click on this oops not loging sorry let's go back to the homepage we want to click on log out and when we do that yeah we get redirected now back to the login page cool