shahriar_shaon's avatar

shahriar_shaon wrote a reply+100 XP

5mos ago

Session timeouts

It will work, but it’s not safe or recommended.

Invalidating or regenerating a session changes the application state, and GET requests should be read-only. GET routes are not CSRF-protected and can be triggered unintentionally (by browsers, bots, or malicious sites).

Use a POST route with CSRF protection for logout or session regeneration instead.

Route::post('/logout', function (Request $request) {
	Auth::logout();

    $request->session()->invalidate();
    $request->session()->regenerateToken();

    return response()->json(['message' => 'Logged out']);
});