1

I'm using JWT-auth with Laravel Framework to authenticate a user. Laravel is used as server-end framework and the fore-end code is in the framework which is developed by our own. So we use api not web to realize authentication. Login works well in this environment, whereas logout and refresh token can't perform as I wish. I configure everything as JWT-auth documentation says.

route.php

Route::group(['middleware' => 'api', 'prefix' => 'user', 'namespace' => 'User'], function () {
   Route::post('/login', 'AuthController@login'); // login
   Route::post('/logout', 'AuthController@logout'); // logout (invalidate token)
   Route::post('/refresh', 'AuthController@refresh'); // refresh token});

kernel.php

protected $middlewareGroups = [
    'web' => [
        \App\Http\Middleware\EncryptCookies::class,
        \Illuminate\Cookie\Middleware\AddQueuedCookiesToResponse::class,
        \Illuminate\Session\Middleware\StartSession::class,
        // \Illuminate\Session\Middleware\AuthenticateSession::class,
        \Illuminate\View\Middleware\ShareErrorsFromSession::class,
        \App\Http\Middleware\VerifyCsrfToken::class,
        \Illuminate\Routing\Middleware\SubstituteBindings::class,
    ],

    'api' => [
        'throttle:60,1',
        'bindings',
    ],
];

auth.php

'guards' => [
    'web' => [
        'driver' => 'session',
        'provider' => 'users',
    ],

    'api' => [
        'driver' => 'jwt',
        'provider' => 'users',
    ],
],

'providers' => [
    'users' => [
        'driver' => 'password',
        'model' => App\User::class,
    ],

    /*'users' => [
        'driver' => 'database',
        'table' => 'user',
    ],*/
],

User\AuthController

<?php

namespace App\Http\Controllers\User;

use Illuminate\Support\Facades\Auth;
use App\Http\Controllers\Controller;
use Illuminate\Http\Request;
use AjaxResponse;
use Log;

class AuthController extends Controller
{
    /**
     * Create a new AuthController instance.
     *
     * @return void
     */
    public function __construct()
    {
        $this->middleware('auth:api', ['except' => ['login']]);
    }

    /**
     * login
     * @param Request $request 
     * @return mixed
     */
    public function login(Request $request)
    {
        $credentials = $request->only('phone', 'password');

        if (! $token = auth()->attempt($credentials)) {
            return AjaxResponse::fail(4001);
        }

        return $this->respondWithToken($token);
    }

    /**
     * logout(invalidate token)
     * @return \Illuminate\Http\JsonResponse
     */
    public function logout()
    {
        Log::debug('yyyyyyyyy');
        auth()->logout();

        return AjaxResponse::succeed(['message' => 'Successfully logged out']);
    }

    /**
     * refresh token
     * @return \Illuminate\Http\JsonResponse
     */
    public function refresh()
    {
        return $this->respondWithToken(auth()->refresh());
    }

    /**
     * get token structure
     * @param $token
     * @return mixed
     */
    protected function respondWithToken($token)
    {
        if (Auth::user()['deleted_at'] || ! Auth::user()['is_active'])
            return AjaxResponse::fail(4001);
        else
            return AjaxResponse::succeed([
                'access_token' => $token,
                'token_type' => 'bearer',
                'expires_in' => auth()->factory()->getTTL() * 60,
                'user_name' => Auth::user()['name'],
                'user_admin' => (bool)Auth::user()['is_admin']
            ]);
    }
}

Here posts my response to access logout.

'yyyyyyyyy' can't be logged. So it seems that the logout function in AuthController wasn't called.

Is there anything wrong I've written or missed? Thanks in advance.

5
  • Is the message log yyyyyyyyy working? is the message 'Successfully logged out''s returning? Or it simply, the token that are not invalided? Commented Feb 22, 2019 at 14:52
  • @cbaconnier I've updated my question just now. Please recheck it. Commented Feb 24, 2019 at 16:03
  • Your screenshot is the results of your POST when you hit /logout is that right? In that case, the request you do may be wrong. Since you're using the API, it should be Content-Type: application/json and the header should contain Authorization: Bearer <token> Commented Feb 25, 2019 at 7:30
  • In addition of what I explained: the request you do may be wrong. I'm guessing this since I'm seeing an HTML screenshot. Laravel's generally redirects you to /login (not /api/login) because it doesn't see the request as json and doesn't see you authenticated. Commented Feb 25, 2019 at 16:35
  • @cbaconnier I've found a way to make it work, nonetheless, I don't explain the logic clearly. Commented Mar 11, 2019 at 2:22

1 Answer 1

0

After a few tryings, I've changed the AuthController's constructor and it worked.

User\AuthController

public function __construct()
{
    $this->middleware('auth:api', ['except' => ['login', 'refresh', 'logout']]);
}

I've added functions as value of 'except', in which I expected to invalidate the present session.

Sign up to request clarification or add additional context in comments.

Comments

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.