Hey guys.
So in this video you're going to see how can we actually log out the user.
But first what we are missing here is we don't really have a sign in link.
That's why this is the thing I'm going to add.
First we need an alternative here.
And let me just add a link to the login page.
Why won't we just call it log in.
So it should look like this I'm not authenticated.
I should be able to go to the login page.
And then we are going to implement this step.
We're going to clear the user ID from the session.
Or even better we are going to destroy the whole session just to make sure that if we sign out there
are no traces left.
So let's jump to the auth controller.
So we've got the create method for displaying the form the store star method for signing in.
Now let me add another one.
We're going to call it destroy.
So let me add the destroy method.
Now again I'm calling those actions the way they would be typically called in a Laravel application.
I think it makes sense for couple of reasons.
The first is there is a high probability you are going to use Laravel as a PHP developer.
So it's good to be accustomed with Laravel conventions.
And the second reason is I think that the conventions in Laravel are so good that they should be applied
everywhere.
So by naming the actions using the same conventions, we just make it so much easier to understand to
everyone what's happening inside a specific controller.
If we stick to conventions, So create is about displaying a form to create a resource store is creating
that resource.
In our case it is creating an authenticated user.
So destroy would destroy the authenticated user, which means it would destroy his session.
I think it all makes perfect sense.
So we're going to use an hourglass here.
We should have a logout method which we don't have.
And we obviously need to create it.
And then we're going to redirect to a login page.
This also makes sense after you sign out.
So this is void.
So I properly don't return anything from this.
And now let me jump to routes.
So since the logging out is not really a safe operation and it changes the state on the server, we
should not use the get verb for it, because there are a couple of reasons we shouldn't do that.
Once is all the pages that use get verb are vulnerable to cross-site request forgery.
Think I've explained and we protect it from in the previous project.
And we are about to add that to this project as well.
So an attacker might trick you into logging out.
Then some browsers might try to prefetch all the pages.
That or all the links that use the Get request, which might inadvertently lead you to logging out.
Sometimes pages or URLs that use this Get request might also be cached.
So there are a lot of potential problems we might be running into.
That's why operations that do things like this, they change the state on the server, which means calling
them again would not yield the same result.
Which means they are not idempotent, as this is professionally called.
You should at least use post preferably that would be a delete request.
It's not easy to do a delete request from within HTML and forms.
We would have to use JavaScript.
That's why I'm going to use post for that.
So we will have to submit a form.
This leads to auth controller destroy.
Let me add the forward slash here as well.
And now we should implement this method.
So let's jump to the auth class and let's add a static logout.
And I don't think it should return anything.
So it's void.
So the first thing we should do is we should destroy the session.
It's important that if the session should no longer be authenticated, we should destroy everything.
Delete all the data that was inside the session.
That's the first thing we do.
We've got this static user field.
Let's reset it to null.
So we are sign out.
There is no user.
That's actually everything.
We just made sure that everything from the session is being wiped out.
Now we should jump to the layout.
And since that's a Post request or this logout route is using the Post method, it can't be just a link.
So a elements can't direct you to a URL uri that is using a Post Request here.
We need to submit a form.
Yes, that is extra work, but I just want you to use the best security practices.
So there is no way we're going to use a link to perform a logout.
That's why we just need to go ahead and add this form.
So the form action is forward slash logout.
We need to submit this form.
So let me add a button I'm going to call it logout.
It's important that the method here is post.
And let me just add the user email and remove this link.
Now sure this won't look perfect but in reality You can style the buttons the way that they look like
links, so I don't think there should be any problem.
Now let's see how does it work?
So let me authenticate using admin example.com.
Let me check the password.
So that's admin example.com.
The password is admin 123.
Let's see if everything works fine.
Okay.
So yeah that's not perfect.
But at least we are safe.
And as I've said it's totally not hard to style this button the way.
So it looks like a link.
Now let's verify if the logout works.
And then later on we might worry about styling our page a little bit better.
So I'm pressing the link and we were signed out properly, which confirms that everything works fine.