Laravel 5.6：强制注销记住我的登录信息

Question

I have a custom login controller in my app, which prevents multiple sessions per user. It logs out the user if they log in from another device/browser:

public function authenticated(Request $request, $user) {
  $previous_session = $user->session_id;

  if ($previous_session) {
    session()->getHandler()->destroy($previous_session);
  }

  auth()->user()->session_id = session()->getId();
  auth()->user()->save();

  return redirect(session()->pull('from', $this->redirectTo));
}

Regardless of the session driver, this code looks for a session_id on users table and destroys the session associated with it.

But this doesn't work if the user logged in with remember me checkbox enabled. User stays logged in with previous device/browser. How can I tell laravel to forget this remember me after the second login? Thanks.

Answer 1

You have to invalidate or cycle the remember_token in the users database table.

This happens automatically when you call Auth::logout() .

The remember_token can also be invalidated manually similiar to how Laravel handles it:

protected function cycleRememberToken(AuthenticatableContract $user)
{
    $user->setRememberToken($token = Str::random(60));

    $this->provider->updateRememberToken($user, $token);
}

Source: laravel/framework/src/Illuminate/Auth/SessionGuard.php