Be part of JetBrains PHPverse 2026 on June 9 – a free online event bringing PHP devs worldwide together.

devondahon's avatar

Remove Laravel user session after Laravel Passport sends token to a frontend SPA app

Where should I call my deleteUserSession() method below after Laravel Passport sends back a token to my SPA frontend ?

    public function deleteUserSession(Request $request)
    {
        return DB::table('sessions')
            ->whereUserId($request->user()->id)
            ->delete();
    }

Currently, I'm calling this deleteUserSession() method together with a revokeUserToken() method when the frontend LOGOUT button is pressed, but I would like to limit the logout to revokeUserToken() method and call deleteUserSession() method earlier, at login.

    public function deleteUserSession(Request $request)
    {
        return DB::table('public.sessions')
            ->whereUserId($request->user()->id)
            ->delete();
    }

    public function revokeUserToken(Request $request)
    {
        // Revoke token
        $request->user()->token()->revoke();
        // Revoke refresh token
        $refreshTokenRepository = app('Laravel\Passport\RefreshTokenRepository');
        $refreshTokenRepository->revokeRefreshTokensByAccessTokenId(
            $request->user()->token()->id
        );
        return;
    }
0 likes
4 replies
devondahon's avatar

@martinbean The user needs to authenticate in the backend to get the authorization code and token before. Otherwise, how would it work ?

devondahon's avatar
devondahon
OP
Best Answer
Level 3

Finally, I'm removing the user session in the first call made by the frontend (using token), which is the a getUserInformation method:

return DB::table('public.sessions')
    ->whereUserId($request->user()->id)
    ->delete();

Please or to participate in this conversation.