Level 4
Anybody can help?
May 10, 2022
6
Level 4
Can't delete/logout users session from database driver
I'm using database driver for storing user sessions. I can see user being logged in on 3 devices (session table has 3 rows with given user_id). How do logout ONE of his sessions?
I tried deleting row from database. Also using session() helper. Nothing works. Once the user refreshes (F5) page on given device it will reinsert row back into table?
Level 56
Once the user refreshes (F5) page on given device it will reinsert row back into table?
Yes. That is the expected behavior.
If a user visits your site/app and they either don't have a session cookie, or the session cookie is invalid, Laravel will create a new session id, save it to the session store (your database in your config) and send the session ID encrypted as a cookie back to the user.
This happens even for unauthenticated users. As long the endpoint they are visiting uses session.
It seems you wanted to have only rows for logged in users. Unfortunately this is not how it works. You could want to save some data for a guest user, for example on an e-commerce site, you might allow a guest user to add some products to a cart, and once they log in you migrate that cart to their logged in session.
When you delete the row, and the user refreshes the page, does they keep logged in? If not, don't worry with these session records, it is expected behavior. And once in a while Laravel will clean up stale sessions automatically.
Level 4
After 2 days I managed to figure it out by myself. Problem was the remember_me function.
When I deleted session from the table and user refreshed his browser remember_me function would insert back in table new logged in session. But after disabling remember_me when I delete session and user refreshes browser his newly created session will be only as a guest.
So now I can manage logged in users and remotely log them out.
2 likes
Level 56
@andyandy yeah, I forgot about the remember me. Great you figured it out! Have a nice day =)
Level 1
@andyandy Could you specify what exactly you are doing? How do you disable remember me (for a specific session/device)? I have tried to find the code behind Auth::logoutOtherDevices(), which seems to be doing this (although for all other devices and not a specific one), but I was not able to find the actual code.
I did some testing and found out that the users table get affected by the logoutOtherDevices() as well. The remember_token column is unchanged, but the password column is changed. What is going on here?
Is it even possible to achieve logging out specific user sessions and keep the user logged in on the rest of the sessions?
My app is running on jetstream with sanctum and fortify, btw.
Level 1
hello @Laban , did you found any solution for this situation?
Please or to participate in this conversation.