Does flushing the session log you out?

On Friday, I shared a tip about being precise when clearing session values.

Someone replied to that tip asking an interesting question: Wouldn't using the more blunt session()->flush() method also log out the current user?

The particular workflow I had in mind when sharing the tip didn't involve a logged-in user, so I wasn't even thinking about that. But it is an interesting question, so let's explore it.

As is so often true in the world of programming, the answer is: it depends.

First, let's assume you are using the typical "web" authentication guard with the default session driver and user provider.

This guard stores the currently logged-in user ID in the session. It looks something like this:

// partial output of session()->all()
[
    'login_web_59ba36addc2b2f9401580f014c7f58ea4e30989d' => 4832, // some user ID
]

So by flushing that, on the next request, Laravel will not find the user ID in the session, so you could be logged out.

Why do I say "could be" and not "will be"? There's also the possibility that the user is still logged in via a cookie.

In that case, the SessionGuard will fall back to retrieving the user from the cookie, and then repopulate the session with the user ID automatically.

Also notice that I said "on the next request Laravel will not find the user ID in the session." That's another key distinction.

If you flush the session in a controller action and then return a view, the AuthenticateSession middleware will have already run and set the user on the current request. So you could call request()->user() or anything on the Auth facade in the view, and it would return the proper user.

It wouldn't be until the next request that you'd have the possibility of being logged out, if no auth "remember" cookie was in place.

In any case, this is further evidence that you should be precise when clearing session values.

Here to help,

Joel

P.S. Do you work alone or on a small team and wish you had a mentor to help you level up your Laravel skills? If you'd like to explore how that could work, contact us to schedule a call.