Login and logout in Laravel - Mini Project: Build & Apply

Login and logout

📖 Scenario: You are building a simple web application where users can securely log in and log out. This helps protect their personal data and control access.

🎯 Goal: Create a basic Laravel login and logout system using built-in authentication features. Users will enter their email and password to log in, and they can log out with a button.

📋 What You'll Learn

Create a route for showing the login form

Create a route to handle login form submission

Create a route to handle logout

Use Laravel's Auth facade to authenticate users

Redirect users after login and logout appropriately

💡 Why This Matters

🌍 Real World

Login and logout systems are essential for almost all web applications to protect user data and control access.

💼 Career

Understanding Laravel authentication is a key skill for backend web developers working with PHP frameworks.

1

Set up login routes

Create two routes in routes/web.php: one GET route named login that returns the login view, and one POST route named login that will handle the login form submission.

Laravel

// Your code here

Hint

Use Route::get for showing the form and Route::post for processing the form.

2

Add logout route

Add a POST route named logout in routes/web.php that will handle logging the user out using Laravel's Auth facade.

Laravel

use Illuminate\Support\Facades\Route;

Route::get('/login', function () {
    return view('login');
})->name('login');

Route::post('/login', function () {
    // Login logic will go here
});

// Your code here

Hint

Use Auth::logout() to log the user out and then redirect to the login page.

3

Implement login logic

In the POST /login route, use request()->only('email', 'password') to get credentials, then use Auth::attempt() to try logging in. If successful, redirect to /dashboard, else redirect back to /login with errors.

Laravel

use Illuminate\Support\Facades\Route;
use Illuminate\Support\Facades\Auth;

Route::get('/login', function () {
    return view('login');
})->name('login');

Route::post('/login', function () {
    // Add login logic here
});

Route::post('/logout', function () {
    Auth::logout();
    return redirect('/login');
})->name('logout');

Hint

Use Auth::attempt() to check credentials and redirect accordingly.

4

Create login view with form

Create a Blade view file named login.blade.php in resources/views with a simple HTML form. The form should have email and password inputs, use POST method to /login, and include a CSRF token. Also add a logout form that posts to /logout with a button.

Laravel

name('login');

Route::post('/login', function () {
    $credentials = request()->only('email', 'password');
    if (Auth::attempt($credentials)) {
        return redirect('/dashboard');
    }
    return redirect('/login')->withErrors(['email' => 'Invalid credentials']);
});

Route::post('/logout', function () {
    Auth::logout();
    return redirect('/login');
})->name('logout');

// Create login.blade.php with form and logout button

Hint

Use Blade syntax for CSRF token and create forms with correct method and action.

Practice

1. What does the Auth::attempt() method do in Laravel's login process?

easy

A. It registers a new user in the database.

B. It logs out the user and clears the session.

C. It checks user credentials and starts a session if valid.

D. It sends a password reset email to the user.

Solution

1. Step 1: Understand Auth::attempt() purpose

   This method tries to verify the user's email and password against stored data.

2. Step 2: Recognize session start on success

   If credentials are correct, Laravel starts a session to keep the user logged in.

3. Final Answer:

   It checks user credentials and starts a session if valid. -> Option C

4. Quick Check:

   Auth::attempt() = Check credentials + start session [OK]

Hint: Auth::attempt() means login check and session start [OK]

Common Mistakes:

• Confusing Auth::attempt() with logout method
• Thinking it registers new users
• Assuming it sends emails

2. Which of the following is the correct syntax to log out a user in Laravel?

easy

A. Auth::logout();

B. Auth::end();

C. Auth::exit();

D. Auth::close();

Solution

1. Step 1: Identify Laravel logout method

   The correct method to log out a user is Auth::logout().

2. Step 2: Check other options for validity

   Methods like end(), exit(), and close() do not exist in Laravel's Auth facade.

3. Final Answer:

   Auth::logout(); -> Option A

4. Quick Check:

   Logout method = Auth::logout() [OK]

Hint: Logout always uses Auth::logout() in Laravel [OK]

Common Mistakes:

• Using non-existent methods like Auth::end()
• Confusing logout with session destroy
• Forgetting parentheses after logout

3. Given this Laravel controller code, what will return Auth::check(); output after a successful login?

medium

A. true

B. false

C. null

D. Throws an error

Solution

1. Step 1: Understand Auth::check() function

   This method returns true if a user is currently logged in (session active).

2. Step 2: Consider successful login state

   After a successful login, the session is active, so Auth::check() returns true.

3. Final Answer:

   true -> Option A

4. Quick Check:

   Auth::check() after login = true [OK]

Hint: Auth::check() tells if user is logged in [OK]

Common Mistakes:

• Thinking it returns user data instead of boolean
• Assuming it returns false after login
• Expecting null or error

4. Identify the error in this Laravel logout code snippet:

public function logout() {
    Auth::logout;
    return redirect('/login');
}

medium

A. Redirect URL is incorrect

B. Missing parentheses after Auth::logout

C. logout method should be called on user model

D. No error, code is correct

Solution

1. Step 1: Check method call syntax

   Methods in PHP require parentheses even if no arguments are passed. Auth::logout misses parentheses.

2. Step 2: Validate redirect URL and method usage

   The redirect URL '/login' is valid and logout is correctly called on Auth facade, so no issues there.

3. Final Answer:

   Missing parentheses after Auth::logout -> Option B

4. Quick Check:

   Method calls need () in PHP [OK]

Hint: Always add () when calling methods in PHP [OK]

Common Mistakes:

• Forgetting parentheses on method calls
• Thinking redirect URL causes error
• Calling logout on wrong object

5. You want to protect a route so only logged-in users can access it and redirect guests to login. Which Laravel middleware should you use?

hard

A. guest

B. throttle

C. verified

D. auth

Solution

1. Step 1: Understand middleware roles

   The auth middleware allows only authenticated users to access routes.

2. Step 2: Compare other middleware

   guest redirects logged-in users away, verified checks email verification, and throttle limits request rate.

3. Final Answer:

   auth -> Option D

4. Quick Check:

   Protect routes for logged-in users = auth middleware [OK]

Hint: Use auth middleware to restrict routes to logged-in users [OK]

Common Mistakes:

• Using guest middleware which blocks logged-in users
• Confusing verified with auth
• Thinking throttle controls login access