Cakephp 3 - force logout on session timeout

Question

I'm struggling with the auth component. My authentication is managed inside a plugin. In the plugin's AppController.php I have set up this :

    $this->loadComponent('Auth', [
                                   'authenticate'      => [ 'Form' => [ 'userModel' => 'BasUsers' ] ],
                                   'loginAction'       => [ 'controller' => 'BasUsers', 'action' => 'login', 'plugin' => 'Basic' ],            
                                   'userModel'         => 'BasUsers',
                                   'loginRedirect'     => '/pages/home',
                                   'logoutRedirect'    => [ 'controller' => 'BasUsers', 'action' => 'login', 'plugin' => 'Basic' ],
                                   'unauthorizedRedirect' => [ 'controller' => 'pages', 'action' => 'not-authorized' ],
                                   'authError'         => false,
                                   'authorize' => ['Controller'],
                                ]
                         );

I cannot manage to force a logout ( redirect to the login page ) when the session expires.

When the session ends, trying $this->request->session()->read( 'Auth.User.bas_users_role_id' ) returns null, but the controller / action is executed.

What am I missing ? Thanks.

check for auth allow function...you may you are allowing all the actions in controller. like $this->Auth->allow(); .restricting/removing it may solve your problem. — Shashikala

Benfarhat Benfarhat · Accepted Answer · 2017-08-13T22:10:22

1 - Maybe your browser retain your credential

2 - In your Appcontroler try to use isAuthorized function

public function isAuthorized($user)
{
if(is_null($this->request->session()->read( 'Auth.User.bas_users_role_id' )  ) :
    return $this->redirect(
        [ 'controller' => 'BasUsers', 'action' => 'login', 'plugin' => 'Basic' ]
    );
else: 
// your code
endif;
}

Cakephp 3 - force logout on session timeout

1 Answers