Login and logout in Laravel

Introduction

Login and logout let users enter and leave your website safely. This keeps their information private and controls who can see certain pages.

When you want users to access their personal accounts on your website.

When you need to protect parts of your site from visitors who are not signed in.

When you want to keep track of who is using your site and what they do.

When you want to let users end their session to keep their account safe.

Syntax

Laravel

<?php
// Login example
if (Auth::attempt(['email' => $email, 'password' => $password])) {
    // Login success
    return redirect()->intended('dashboard');
} else {
    // Login failed
    return back()->withErrors(['email' => 'Invalid credentials']);
}

// Logout example
Auth::logout();
return redirect('/login');

Use Auth::attempt() to check user credentials and log them in.

Use Auth::logout() to log the user out and clear their session.

Examples

This tries to log in a user with email and password. If it works, it sends them to the home page.

Laravel

<?php
// Simple login check
if (Auth::attempt(['email' => $email, 'password' => $password])) {
    return redirect('/home');
}

This logs out the current user and sends them to the login page.

Laravel

<?php
// Logging out a user
Auth::logout();
return redirect('/login');

This sends the user to the page they wanted before login, or to the dashboard if none.

Laravel

<?php
// Redirect after login
if (Auth::attempt(['email' => $email, 'password' => $password])) {
    return redirect()->intended('dashboard');
}

Sample Program

This controller handles showing the login form, logging in users by checking their email and password, and logging them out safely by clearing their session.

Laravel

<?php
namespace AppHttpControllers;

use IlluminateHttpRequest;
use IlluminateSupportFacadesAuth;

class AuthController extends Controller
{
    public function showLoginForm()
    {
        return view('login');
    }

    public function login(Request $request)
    {
        $credentials = $request->validate([
            'email' => ['required', 'email'],
            'password' => ['required'],
        ]);

        if (Auth::attempt($credentials)) {
            $request->session()->regenerate();
            return redirect()->intended('dashboard');
        }

        return back()->withErrors([
            'email' => 'The provided credentials do not match our records.',
        ]);
    }

    public function logout(Request $request)
    {
        Auth::logout();

        $request->session()->invalidate();
        $request->session()->regenerateToken();

        return redirect('/login');
    }
}

Important Notes

Always validate user input before trying to log in.

Regenerate the session after login to prevent security issues.

Invalidate and regenerate the session token on logout to keep sessions safe.

Summary

Login checks user email and password to allow access.

Logout ends the user session and protects their account.

Laravel's Auth facade makes login and logout easy and secure.

Practice

1. What does the Auth::attempt() method do in Laravel's login process?

easy

A. It registers a new user in the database.

B. It logs out the user and clears the session.

C. It checks user credentials and starts a session if valid.

D. It sends a password reset email to the user.

Solution

1. Step 1: Understand Auth::attempt() purpose

   This method tries to verify the user's email and password against stored data.

2. Step 2: Recognize session start on success

   If credentials are correct, Laravel starts a session to keep the user logged in.

3. Final Answer:

   It checks user credentials and starts a session if valid. -> Option C

4. Quick Check:

   Auth::attempt() = Check credentials + start session [OK]

Hint: Auth::attempt() means login check and session start [OK]

Common Mistakes:

• Confusing Auth::attempt() with logout method
• Thinking it registers new users
• Assuming it sends emails

2. Which of the following is the correct syntax to log out a user in Laravel?

easy

A. Auth::logout();

B. Auth::end();

C. Auth::exit();

D. Auth::close();

Solution

1. Step 1: Identify Laravel logout method

   The correct method to log out a user is Auth::logout().

2. Step 2: Check other options for validity

   Methods like end(), exit(), and close() do not exist in Laravel's Auth facade.

3. Final Answer:

   Auth::logout(); -> Option A

4. Quick Check:

   Logout method = Auth::logout() [OK]

Hint: Logout always uses Auth::logout() in Laravel [OK]

Common Mistakes:

• Using non-existent methods like Auth::end()
• Confusing logout with session destroy
• Forgetting parentheses after logout

3. Given this Laravel controller code, what will return Auth::check(); output after a successful login?

medium

A. true

B. false

C. null

D. Throws an error

Solution

1. Step 1: Understand Auth::check() function

   This method returns true if a user is currently logged in (session active).

2. Step 2: Consider successful login state

   After a successful login, the session is active, so Auth::check() returns true.

3. Final Answer:

   true -> Option A

4. Quick Check:

   Auth::check() after login = true [OK]

Hint: Auth::check() tells if user is logged in [OK]

Common Mistakes:

• Thinking it returns user data instead of boolean
• Assuming it returns false after login
• Expecting null or error

4. Identify the error in this Laravel logout code snippet:

public function logout() {
    Auth::logout;
    return redirect('/login');
}

medium

A. Redirect URL is incorrect

B. Missing parentheses after Auth::logout

C. logout method should be called on user model

D. No error, code is correct

Solution

1. Step 1: Check method call syntax

   Methods in PHP require parentheses even if no arguments are passed. Auth::logout misses parentheses.

2. Step 2: Validate redirect URL and method usage

   The redirect URL '/login' is valid and logout is correctly called on Auth facade, so no issues there.

3. Final Answer:

   Missing parentheses after Auth::logout -> Option B

4. Quick Check:

   Method calls need () in PHP [OK]

Hint: Always add () when calling methods in PHP [OK]

Common Mistakes:

• Forgetting parentheses on method calls
• Thinking redirect URL causes error
• Calling logout on wrong object

5. You want to protect a route so only logged-in users can access it and redirect guests to login. Which Laravel middleware should you use?

hard

A. guest

B. throttle

C. verified

D. auth

Solution

1. Step 1: Understand middleware roles

   The auth middleware allows only authenticated users to access routes.

2. Step 2: Compare other middleware

   guest redirects logged-in users away, verified checks email verification, and throttle limits request rate.

3. Final Answer:

   auth -> Option D

4. Quick Check:

   Protect routes for logged-in users = auth middleware [OK]

Hint: Use auth middleware to restrict routes to logged-in users [OK]

Common Mistakes:

• Using guest middleware which blocks logged-in users
• Confusing verified with auth
• Thinking throttle controls login access