#Questions about logging out user on other devices

7 messages · Page 1 of 1 (latest)

real shell
#

To make my questions simpler to understand, I am looking into the defaut vue inertia starter kit.

In there, the user can change their password. As I read in the docs, a good security measure is to use Auth::logoutOtherDevices after this step. So, here are my questions:

  1. can I use it after I use Password::reset (which is called when the user forgot his password)?
  2. if I am logged as another user, is there a way for me, to programatically logout a user?
vocal token
#

  1. It's not necessary. When the password is changed, their existing sessions are logged out automatically in the AuthenticateSession middleware: https://github.com/laravel/framework/blob/5d777bd4e11e80a71bced6b034f918f086f18527/src/Illuminate/Session/Middleware/AuthenticateSession.php#L62-L64

  2. Auth::logoutOtherDevices() only works if you provide it with the user's current password in plaintext, so that won't work. The only solution I can think of, is to delete their existing sessions from the session store manually. If you use database sessions, you can just call DB::table('sessions')->where('user_id', $id)->delete(), but I don't know if it's possible with redis or file based sessions.

GitHub
framework/src/Illuminate/Session/Middleware/AuthenticateSession.php...

The Laravel Framework. Contribute to laravel/framework development by creating an account on GitHub.

real shell
#
  1. then why does the docs https://laravel.com/docs/12.x/authentication#invalidating-sessions-on-other-devices says "This feature is typically utilized when a user is changing or updating their password and you would like to invalidate sessions on other devicesc" if the sessions will be logged out anyway? Or am i missing something?
Authentication - Laravel 12.x - The PHP Framework For Web Artisans

Laravel is a PHP web application framework with expressive, elegant syntax. We’ve already laid the foundation — freeing you to create without sweating the small things.

real shell
vocal token
#

I mean it's pretty easy to verify yourself. Log in in one.browser and reset the password in another. Then refresh the page in the first browser and see if you're still logged in.

real shell
vocal token
#

My answer was actually kind of misleading. It only works if you use the auth.session middleware on all auth routes. But then again, that's also the case for Auth::logoutOtherDevices().
I agree that the documentation is super confusing on this topic. I've submitted a PR to the docs that hopefully makes it a bit more clear.