How to logout a user from API using laravel Passport

问题

I'm currently using 2 projects. 1 front end (with laravel backend to communicate with API) and another laravel project (the API).

Now I use Laravel Passport to authenticate users and to make sure every API call is an authorized call.

Now when I want to log out my user, I send a post request to my API (with Bearer token) and try to log him out of the API (and clear session, cookies,...)

Then on the client I also refresh my session so the token is no longer known. Now when I go back to the login page, it automatically logs in my user. (Or my user is just still logged in).

Can someone explain me how to properly log out a user with Laravel passport?

Thanks in advance.

回答1:

You need to delete the token from the database table oauth_access_tokens you can do that by creating a new model like OauthAccessToken

Run the command php artisan make:model OauthAccessToken to create the model.
Then create a relation between the User model and the new created OauthAccessToken Model , in User.php add :
```
public function AauthAcessToken(){
    return $this->hasMany('\App\OauthAccessToken');
}
```

in UserController.php , create a new function for logout:

public function logoutApi()
{ 
    if (Auth::check()) {
       Auth::user()->AauthAcessToken()->delete();
    }
}

In api.php router , create new route :

 Route::post('logout','UserController@logoutApi');

Now you can logout by calling posting to URL /api/logout

回答2:

Make sure that in User model, you have this imported

use Laravel\Passport\HasApiTokens;

and you're using the trait HasApiTokens using

use HasApiTokens

inside the user class. Now you create the log out route and in the controller, do this

$user = Auth::user()->token();
$user->revoke();
return 'logged out'; // modify as per your need

This will log the user out from the current device where he requested to log out. If you want to log out from all the devices where he's logged in. Then do this instead

DB::table('oauth_access_tokens')
        ->where('user_id', Auth::user()->id)
        ->update([
            'revoked' => true
        ]);

This will log the user out from everywhere. This really comes into help when the user changes his password using reset password or forget password option and you have to log the user out from everywhere.

回答3:

Create a route for logout:

$router->group(['middleware' => 'auth:api'], function () use ($router) {
    Route::get('me/logout', 'UserController@logout');
});

Create a logout function in userController ( or as mentioned in your route)

public function logout() {
        $accessToken = Auth::user()->token();
        DB::table('oauth_refresh_tokens')
            ->where('access_token_id', $accessToken->id)
            ->update([
                'revoked' => true
            ]);

        $accessToken->revoke();
        return response()->json(null, 204);
    }

回答4:

This is sample code i'm used for log out

public function logout(Request $request)
{
    $request->user()->token()->revoke();
    return response()->json([
        'message' => 'Successfully logged out'
    ]);
}

来源：https://stackoverflow.com/questions/43318310/how-to-logout-a-user-from-api-using-laravel-passport

标签

laravel

laravel-passport