Logging out with HTTP Basic Auth in Laravel

Question

I have one user class which consists of two types of users and want to allow different users to go to different pages.

I have created a filter as follows

Route::filter('isExpert', function()
{
    $userIsExpert = 0;
    $userIsLoggedIn = Auth::check();
    if ($userIsLoggedIn && Auth::user()->role == 'expert') {
    $userIsExpert = 1;
    }

    Log::info('Logged in: ' . $userIsLoggedIn . ' && Expert: ' . $userIsExpert);
    if ($userIsExpert == 0)
    {
        Log::info('should be logging out now.');
        Auth::logout();
        return Auth::basic();
    }
});

And routing like so

Route::get('/winners', array('before' => 'isExpert', function()
{
    $winners = DB::select('select * from winners');
    return View::make('winners.index')->with('winners',$winners);
}));

The thought is this: If it's not an expert, it will logout and redirect to login page. If it is, it will simply continue. However, Auth::logout(); doesn't ever log out the user.

Question

Why is not Auth::logout() working? I've tried placing it anywhere in the app to no avail.

cheers

Try to redirect to a different route instead of returning the Auth::basic() response. Technically your code should be working. You can also try a dd(Auth::check()) after you logout to see if the logout worked correctly. — Jason Lewis
– Jason Lewis, Commented Aug 18, 2013 at 8:22
Ok. The redirect function works, I can put in a view there and it pops it off. The Auth::logout() doesn't work anywhere in the app. Any ideas why? — C-A
– C-A, Commented Aug 18, 2013 at 17:14

Rob Gordijn · Accepted Answer · 2013-08-19 09:55:27Z

9

I had the same problem, I really couldn't logout the current user... And the answer is simple: Laravel doesn't support logout() with Auth::basic().

There are ways to fix it, but it's not very clean; https://www.google.nl/search?q=logout+basic

answered Aug 19, 2013 at 9:55

Rob Gordijn

6,5211 gold badge25 silver badges29 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Andreas Bergström · Accepted Answer · 2014-03-29 07:01:40Z

4

This is not a limitation to Laravel, HTTP Basic Authorization is not designed to handle logging out. The client will remain logged in until the browser is closed.

HTTP Basic Authorization really shouldn't be used in any public production environment. Here are some reasons why:

No way to give users a "remember me"-option on the login form.
Password managers have no or lacking support for HTTP Basic Auth, as it is not rendered HTML but a native popup.
Terrible user experience. Putting together a proper login form is well worth the little time it takes.

The only valid case I can think of is to protect public development-subdomains like dev.example.com, but there are better ways to solve that as well.

answered Mar 29, 2014 at 7:01

Andreas Bergström

14.7k6 gold badges62 silver badges53 bronze badges

Comments

Endel Dreyer · Accepted Answer · 2013-09-05 21:22:48Z

3

The easiest way that I've found for that is to redirect to invalid username/password on logout route. Example:

Route::get('admin/logout', function() {
    return Redirect::to(preg_replace("/:\/\//", "://log-me-out:fake-pwd@", url('admin/logout')));
});

answered Sep 5, 2013 at 21:22

Endel Dreyer

1,65418 silver badges27 bronze badges

1 Comment

Kingsley Over a year ago

Whenever I try this, I get 500 server error as it's in a redirect loop.

Tarek Kalaji · Accepted Answer · 2014-04-16 13:49:29Z

1

If you implemented these methods in User.php

/**
 * Get the e-mail address where password reminders are sent.
 *
 * @return string
 */
public function getReminderEmail()
{
    return $this->email;
}

public function getRememberToken()
{
    return $this->remember_token;
}

public function setRememberToken($value)
{
    $this->remember_token = $value;
}
    public function getRememberTokenName()
{
    return 'remember_token';
}

add new column with name 'remember_token' to your table 'users' in mysql database, and then log out, finally it solved successfully. to alternate you table use this SQL Command:

ALTER TABLE users ADD remember_token TEXT;

and then press 'Go' button.

edited Apr 16, 2014 at 13:49

answered Apr 16, 2014 at 13:43

Tarek Kalaji

2,25729 silver badges36 bronze badges

Collectives™ on Stack Overflow

Logging out with HTTP Basic Auth in Laravel

4 Answers 4

Comments

Comments

1 Comment

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

4 Answers 4

Comments

Comments

1 Comment

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related