Laravel: How to Log Out a User (Basic & Advanced Techniques)

Introduction
Using the Auth Facade
1. Example: Logout Method in a Controller
Invalidating User Session on Other Devices
Flush Data from a Session as You Log Out
Logout via Middleware
Conclusion

Introduction

Authentication is a crucial part of any web application and being able to control a user’s authentication state is equally important. In Laravel, the auth scaffolding provides all the necessary features to log in and log out users effectively. This guide will walk you through the process of logging out a user from a Laravel application using various methods and scenarios.

Using the Auth Facade

The most straightforward way to log out a user in Laravel is by using the Auth Facade:

use Illuminate\Support\Facades\Auth;

// Log the user out
Auth::logout();

When this code is executed, Laravel will invalidate the user’s current session and they will be logged out of the application. You can place this within any controller method as per your requirements.

Example: Logout Method in a Controller

public function logout(Request $request)
{
    // Get the current user's information
    $user = Auth::user();

    // Log the user out
    Auth::logout();

    // Optionally, you can perform a redirect after logging out
    return redirect('/login')->with('status', 'You have been successfully logged out.');
}

Invalidating User Session on Other Devices

Sometimes, you might want to invalidate a user’s session across all devices. This feature is particularly useful if you suspect that the user’s account has been compromised:

use Illuminate\Support\Facades\Auth;

public function logoutEverywhere(Request $request)
{
    // Get the authenticated user
    $user = Auth::user();

    // Log the user out from all devices except the current one
    $user->logoutOtherDevices(mixed $password);

    return redirect('/')->with('status', 'Logged out from all devices.');
}

You need to ensure that you are using the AuthenticatesUsers trait in your User model. Also, the logoutOtherDevices method requires the current user password for security reasons.

Flush Data from a Session as You Log Out

Laravel allows you to flush all data from the session at the time of logout. This is commonly used to clear any application state specific to the user:

use Illuminate\Support\Facades\Auth;
use Illuminate\Http\Request;

public function completeLogout(Request $request)
{
    // Get the current user's information
    $user = Auth::user();

    // Log the user out
    Auth::logout();

    // Invalidate the current session and regenerate the token
    $request->session()->invalidate();

    // Generate a new session token
    $request->session()->regenerateToken();

    // Redirect the user to the login page
    return redirect('/login');
}

Logout via Middleware

If you need to log out users under certain conditions automatically, for example, when their account is deactivated, using a middleware might be the best option. Middleware are great for handling requests before they hit the application:

use Closure;
use Illuminate\Support\Facades\Auth;

class LogoutInactiveUsers
{
    public function handle($request, Closure $next)
    {
        if (Auth::check() && !Auth::user()->isActive) {
            Auth::logout();
            return redirect('/login')->with('error', 'Your account is not active.');
        }

        return $next($request);
    }
}

To activate the middleware, you have to register it in the Kernel.php file within the HTTP directory of your Laravel application. Here is an example of how that might look like:

// Within 'app\Http\Kernel.php'

protected $routeMiddleware = [
    ...
    'logout.inactive' => \App\Http\Middleware\LogoutInactiveUsers::class,
];

Following that, attach the middleware to a route or a group of routes that require automatic logout check:

Route::group(['middleware' => 'logout.inactive'], function () {
    // Define routes that require the inactivity check here
});

Conclusion

Throughout this guide, we’ve discussed different methods and scenarios for logging out users in a Laravel application. By utilizing the built-in functions and middleware, you can effectively manage user login states to ensure a secure and user-friendly experience within your web application.

Remember that security in web applications is pivotal and carefully managing user sessions is just one aspect of that security. You should always strive to understand and apply best practices when dealing with authentication and user management in Laravel.

Next Article: Laravel: How to retrieve authenticated user

Previous Article: Laravel: Redirecting user to a specific page after login

Series: Laravel & Eloquent Tutorials

PHP

PHP