Closed la40 closed 1 year ago
driesvints
commented
1 year ago I'm not sure why you'd use logout with sanctum? Sanctum is just a token based auth for SPA's. You don't use logout with that as each request is checked separately through the provided token.
la40
commented
1 year ago I also was confused at the beginning because I expected also sanctum to be a token based authentication but the documentation sujest that it is a cookie based authentication for SPA first and then token based.
SPA Authentication Second, Sanctum exists to offer a simple way to authenticate single page applications (SPAs) that need to communicate with a Laravel powered API. These SPAs might exist in the same repository as your Laravel application or might be an entirely separate repository, such as a SPA created using Vue CLI or a Next.js application.
For this feature, Sanctum does not use tokens of any kind. Instead, Sanctum uses Laravel's built-in cookie based session authentication services. Typically, Sanctum utilizes Laravel's web authentication guard to accomplish this. This provides the benefits of CSRF protection, session authentication, as well as protects against leakage of the authentication credentials via XSS.
Sanctum will only attempt to authenticate using cookies when the incoming request originates from your own SPA frontend. When Sanctum examines an incoming HTTP request, it will first check for an authentication cookie and, if none is present, Sanctum will then examine the Authorization header for a valid API token.
If you fallow the documentation you will go to the Logging in part where the documentation sujest you two ways to implement the authentication. If you fallow the manuall implementation you will end with the bug described above.
Logging In Once CSRF protection has been initialized, you should make a POST request to your Laravel application's /login route. This /login route may be implemented manually or using a headless authentication package like Laravel Fortify.
The second way is to use Fortify and if you check the logout method of Fortify you will see that the logout method also use auth (guard) logout method!
https://github.com/laravel/fortify/blob/1.x/src/Http/Controllers/AuthenticatedSessionController.php
/**
* Destroy an authenticated session.
*
* @param \Illuminate\Http\Request $request
* @return \Laravel\Fortify\Contracts\LogoutResponse
*/
public function destroy(Request $request): LogoutResponse
{
$this->guard->logout();
$request->session()->invalidate();
$request->session()->regenerateToken();
return app(LogoutResponse::class);
}I think you should point somewhere in the documentation that if you decide to use the manuall implementation you should destroy the sanctum's cookie based session with
Auth::guard("web")->logout();
notzilly
commented
4 months ago @la40 thanks for the explanation, it was very helpful!
Laravel Version
10.13.5
PHP Version
8.2.6
Database Driver & Version
8.0.33
Description
According to the documentation https://laravel.com/docs/10.x/authentication#logging-out the logout function of the Auth facade should work without pointing the guard just like that:
Unexpectedly I found that it does not work as expected. You should explicitely point the guard and it's working.
I use postman to test the requests and this is the error I got:
Steps To Reproduce
Fresh laravel installation + sanctum
Logout implementation according to the laravel's documentation. https://laravel.com/docs/10.x/authentication#logging-out
Api routes