78

I am having trouble getting my system to log out with PassportJS. It seems the logout route is being called, but its not removing the session. I want it to return 401, if the user is not logged in in specific route. I call authenticateUser to check if user is logged in.

Thanks a lot!

/******* This in index.js *********/
// setup passport for username & passport authentication
adminToolsSetup.setup(passport);

// admin tool login/logout logic
app.post("/adminTool/login",
    passport.authenticate('local', {
        successRedirect: '/adminTool/index.html',
        failureRedirect: '/',
        failureFlash: false })
);
app.get('/adminTool/logout', adminToolsSetup.authenticateUser, function(req, res){
    console.log("logging out");
    console.log(res.user);
    req.logout();
    res.redirect('/');
});


// ******* This is in adminToolSetup ********
// Setting up user authentication to be using user name and passport as authentication method,
// this function will fetch the user information from the user name, and compare the password     for authentication
exports.setup = function(passport) {
    setupLocalStrategy(passport);
    setupSerialization(passport);
}

function setupLocalStrategy(passport) {
    passport.use(new LocalStrategy(
        function(username, password, done) {
            console.log('validating user login');
            dao.retrieveAdminbyName(username, function(err, user) {
                if (err) { return done(err); }
                if (!user) {
                    return done(null, false, { message: 'Incorrect username.' });
                }
                // has password then compare password
                var hashedPassword = crypto.createHash('md5').update(password).digest("hex");
                if (user.adminPassword != hashedPassword) {
                    console.log('incorrect password');
                    return done(null, false, { message: 'Incorrect password.' });
                }
                console.log('user validated');
                return done(null, user);
            });
        }
    ));
}

function setupSerialization(passport) {
    // serialization
    passport.serializeUser(function(user, done) {
        console.log("serialize user");
        done(null, user.adminId);
    });

    // de-serialization
    passport.deserializeUser(function(id, done) {
        dao.retrieveUserById(id, function(err, user) {
            console.log("de-serialize user");
            done(err, user);
        });
    });
}

// authenticating the user as needed
exports.authenticateUser = function(req, res, next) {
    console.log(req.user);
    if (!req.user) {
        return res.send("401 unauthorized", 401);
    }
    next();
}
2
  • In my code I call req.logOut() with upper O case, but regarding the guide your code should work too.
    – balazs
    Jan 11, 2013 at 12:10
  • I have tried lots of solutions but none of them worked for me. Finally, I tried to update package [email protected] to [email protected] and it works!
    – prisan
    Apr 8, 2018 at 2:01

30 Answers 30

92

Brice’s answer is great, but I still noticed an important distinction to make; the Passport guide suggests using .logout() (also aliased as .logOut()) as such:

app.get('/logout', function(req, res){
  req.logout();
  res.redirect('/'); //Can fire before session is destroyed?
});

But as mentioned above, this is unreliable. I found it behaved as expected when implementing Brice’s suggestion like this:

app.get('/logout', function (req, res){
  req.session.destroy(function (err) {
    res.redirect('/'); //Inside a callback… bulletproof!
  });
});

Hope this helps!

6
  • 3
    I just get 'Object #<Session> has no method 'destroy'' as errormessage
    – schlenger
    Nov 13, 2014 at 16:02
  • @schlenger Hmm, the above is using Express 3. Are you using version 4?
    – jlmakes
    Nov 13, 2014 at 22:32
  • 4
    Be careful because, in the example given here, the usage of session.destroy assumes use of the express-sessions module. Other session modules (e.g. mozilla node-client-sessions) adds a destroy method that returns synchronously only and disregards any callback pararmeter. In which case your code will hang
    – frooble
    Mar 5, 2017 at 19:58
  • Are you basing this on client-sessions? It's destroy function doesn't take an argument: github.com/mozilla/node-client-sessions/blob/master/lib/…
    – oztune
    Jan 24, 2018 at 23:48
  • ok I use your second method. The session file in the sessions folder is deleted and the session cookie is removed from the client, but the Node server shows following error message in the console: [session-file-store] will retry, error on last attempt: Error: ENOENT: no such file or directory, open ... how could I fix this? May 18, 2020 at 11:21
43

Ran into the same issue. Using req.session.destroy(); instead of req.logout(); works, but I don't know if this is the best practice.

4
  • 1
    Adding req.session.destroy(); worked for me, I had the same problem
    – Michael
    Sep 4, 2013 at 20:36
  • 3
    req.session.destroy(); worked for me too and remember to clear you cookies with res.clearCookie('cookiename'). However does anyone knows what exactly req.logout() do?
    – Hrushikesh
    Dec 5, 2013 at 23:19
  • @WebHrushi you can find the function in passport/lib/passport/http/request.js. Today both versions stopped working for me, redirect seems in both ways called before the session is finally destroyed. On the redirected page both ways described here seem to be working fine.
    – ztirom
    Dec 20, 2013 at 12:28
  • 3
    I don't like the idea of not using req.logout(), for forward compatibility and whatnot, so I just added req.session.destroy(); after req.logout() and that works fine.
    – Gavin
    Jun 13, 2014 at 12:05
16

session.destroy may be insufficient, to make sure the user is fully logged out you have to clear session cookie as well.

The issue here is that if your application is also used as an API for a single page app (not recommended but quite common) then there can be some request(s) being processed by express that started before logout and end after logout. If this were the case then this longer running request will restore the session in redis after it was deleted. And because the browser still has the same cookie the next time you open the page you will be successfully logged in.

req.session.destroy(function() {
    res.clearCookie('connect.sid');
    res.redirect('/');
});

That's the what maybe happening otherwise:

  1. Req 1 (any request) is received
  2. Req 1 loads session from redis to memory
  3. Logout req received
  4. Logout req loads session
  5. Logout req destroys session
  6. Logout req sends redirect to the browser (cookie is not removed)
  7. Req 1 completes processing
  8. Req 1 saves the session from memory to redis
  9. User opens the page without login dialog because both the cookie and the session are in place

Ideally you need to use token authentication for api calls and only use sessions in web app that only loads pages, but even if your web app is only used to obtain api tokens this race condition is still possible.

1
  • 1
    This solves the issue on the client, rather than on the server, which seems insecure. if connect.sid gets hijacked before you log out it shouldn't allow another party to login as you after you have logged out.
    – Paul S
    May 23, 2018 at 20:46
8

I was having the same issue, and it turned out to not be a problem with Passport functions at all, but rather in the way I was calling my /logout route. I used fetch to call the route:

(Bad)

fetch('/auth/logout')
  .then([other stuff]);

Turns out doing that doesn't send cookies so the session isn't continued and I guess the res.logout() gets applied to a different session? At any rate, doing the following fixes it right up:

(Good)

fetch('/auth/logout', { credentials: 'same-origin' })
  .then([other stuff]);
1
  • Was searching for 4 hours before ending up on this answer, a silly mistake but thanks for pointing out. Oct 3, 2020 at 4:12
7

I was having the same issues, capital O fixed it;

app.get('/logout', function (req, res){
  req.logOut()  // <-- not req.logout();
  res.redirect('/')
});

Edit: this is no longer an issue.

2
6

I used both req.logout() and req.session.destroy() and works fine.

server.get('/logout', (req, res) => {
  req.logout();
  req.session.destroy(()=>{
    res.redirect('/');
  });
});

Just to mention, i use Redis as session store.

2
  • your code can lead to an unexpected behavior if the cache is slow or if you have a middle ware running after the logout logic, you should use req.session.destroy(()=> res.redirect("/")); Jun 27, 2017 at 4:25
  • 1
    session.destroy is asynchronous and requires a callback. You should call res.redirect('/'); in that callback.
    – Green
    Oct 10, 2017 at 5:08
5

I was recently having this same issue and none of the answers fixed the issue for me. Could be wrong but it does seem to have to do with a race condition.

Changing the session details to the options below seems to have fixed the issue for me. I have tested it about 10 times or so now and everything seems to be working correctly.

app.use(session({
    secret: 'secret',
    saveUninitialized: false,
    resave: false
}));

Basically I just changed saveUninitialized and resave from true to false. That seems to have fixed the issue.

Just for reference I'm using the standard req.logout(); method in my logout path. I'm not using the session destroy like other people have mentioned.

app.get('/logout', function(req, res) {
    req.logout();
    res.redirect('/');
});
2
  • 1
    I was having issues with both logout and login occasionally not sticking, and this fixed it for me.
    – Tom Hughes
    May 24, 2017 at 17:27
  • @TomHughes Glad it helped!! May 24, 2017 at 19:44
2

None of the answers worked for me so I will share mine

app.use(session({
    secret: 'some_secret',
    resave: false,
    saveUninitialized: false,
   cookie: {maxAge: 1000} // this is the key
}))

and

router.get('/logout', (req, res, next) => {
    req.logOut()
    req.redirect('/')
})
1

Destroying session by yourself looks weird. I faced with this issue having next configuration:

"express": "^4.12.3",
"passport": "^0.2.1",
"passport-local": "^1.0.0",

I should say that this configuration works well. The reason of my issue was in custom sessionStore that I defined here:

app.use(expressSession({
    ...
    store: dbSessionStore,
    ...
}));

To be sure that your issue here too just comment store line and run without session persisting. If it will work you should dig into your custom session store. In my case set method was defined wrong. When you use req.logout() session store destroy() method not invoked as I thought before. Instead invoked set method with updated session.

Good luck, I hope this answer will help you.

0
1

I got an experience that, sometime it's doesn't work because you fail to to setup passport properly. For example, I do vhost, but on main app I setup passport like this which is wrong.

app.js (why wrong ? please see blockqoute below)

require('./modules/middleware.bodyparser')(app);
require('./modules/middleware.passport')(app);
require('./modules/middleware.session')(app);
require('./modules/app.config.default.js')(app, express);

// default router across domain
app.use('/login', require('./controllers/loginController'));
app.get('/logout', function (req, res) {
    req.logout();
    res.redirect('/');
});

// vhost setup
app.use(vhost('sub1.somehost.dev', require('./app.host.sub1.js')));
app.use(vhost('somehost.dev', require('./app.host.main.js')));

actually, it must not be able to login, but I manage to do that because, I continue to do more mistake. by putting another passport setup here, so session form app.js available to app.host.sub1.js

app.host.sub1.js

// default app configuration
require('./modules/middleware.passport')(app);
require('./modules/app.config.default.js')(app, express);

So, when I want to logout... it's not work because app.js was do something wrong by start initialize passport.js before express-session.js, which is wrong !!.

However, this code can solved the issues anyway as others mention.

app.js

app.get('/logout', function (req, res) {
    req.logout();
    req.session.destroy(function (err) {
        if (err) {
            return next(err);
        }

        // destroy session data
        req.session = null;

        // redirect to homepage
        res.redirect('/');
    });
});

But in my case the correct way is... swap the express-session.js before passport.js

document also mention

Note that enabling session support is entirely optional, though it is recommended for most applications. If enabled, be sure to use express.session() before passport.session() to ensure that the login session is restored in the correct order.

So, resolved logout issue on my case by..

app.js

require('./modules/middleware.bodyparser')(app);
require('./modules/middleware.session')(app);
require('./modules/middleware.passport')(app);
require('./modules/app.config.default.js')(app, express);


// default router across domain
app.use('/login', require('./controllers/loginController'));
app.get('/logout', function (req, res) {
    req.logout();
    res.redirect('/');
});

app.host.sub1.js

// default app configuration
require('./modules/app.config.default.js')(app, express);

and now req.logout(); is work now.

1

Apparently there are multiple possible causes of this issue. In my case the problem was wrong order of declarations i.e. the logout endpoint was declared before passport initialization. The right order is:

app.use(passport.initialize());
app.use(passport.session());


app.get('/logout', function(req, res) {
  req.logout();
  res.redirect('/');
});
1

simply adding req.logOut(); solved this issue ; "O" should be capitalized

1
0

I was having the same issue. Turned out that my version of passport wasn't compatible with Express 4.0. Just need to install an older version.

    npm install --save [email protected]
0

This worked for me:

app.get('/user', restrictRoute, function (req, res) {
  res.header('Cache-Control', 'no-cache, private, no-store, must-revalidate,
              max-stale=0, post-check=0, pre-check=0');
});

It makes sure that your page won't get stored in cache

0

I'm working with a programmer, that suggests to remove user of req:

app.get('/logout', function (req, res){
  req.session.destroy(function (err) {
    req.user = null;
    res.redirect('/'); //Inside a callback… bulletproof!
  });
});

Reason: we need to remove from req(passportjs also doing this but async way) because there is no use of user data after logout even this will save memory and also might be passportjs found user data and may create new session and redirect(but not yet happen) By the ways, this is our responsibility to remove irrelevant thing. PassportJS assign data into req.user after login and also remove if we use req.logout() but it may not works properly some times as NodeJS Asynchronous in nature

0

I faced the similar problem with Passport 0.3.2.

When I use Custom Callback for the passport login and signup the problem persisted.

The problem was solved by upgrading to Passport 0.4.0 and adding the lines

app.get('/logout', function(req, res) {
    req.logOut();
    res.redirect('/');
});
0

Since you are using passport authentication which uses it's own session via the connect.sid cookie this simplest way of dealing with logging out is letting passport handle the session.

app.get('/logout', function(req, res){
  if (req.isAuthenticated()) {
    req.logOut()
    return res.redirect('/') // Handle valid logout
  }

  return res.status(401) // Handle unauthenticated response
})
0

All examples here do a redirect after the req.session.destroy. But do realise that Express will create a new session instantly for the page you are redirecting to. In combination with Postman I found the strange behaviour that doing a Passport-Login right after the logout gives the effect that Passport is successful but cannot store the user id to the session file. The reason is that Postman needs to update the cookie in all requests for this group, and this takes a while. Also the redirect in the callback of the destroy does not help.

I solved it by not doing a redirect but just returning a json message.

0

This is still an issue.

What I did was to use req.session.destroy(function (err) {}); on the server side and on the client side, whenever they logout:

const logout = () => {
    const url = '/users/logout'
    fetch(url)
    setTimeout(function () {
      location.reload();    }, 500);

That way, when refreshing the page, the user is without session. Just make sure you are redirecting to the correct page if no one is authenticated.

Not the best approach, perhaps, but it works.

1
  • Thanks for trying to support. I would suggest fixing the code formatting in your answer. The main snippet you posted isn't valid JS. Oct 12, 2020 at 0:39
0

You can try manually regenerating the session:

app.get('/logout', (req, res) => {
    req.logOut();
    req.session.regenerate(err => {
        err && console.log(err);
    });
    res.redirect('/');
});

This does not remove other data (like passport) from the session.

0

Try this

    app.get('/logout', (req, res) => {
    req.logout();
    req.session.destroy();
    res.redirect('/');
    }
1
  • 3
    Why will this code work? Can you provide more detail around that? Thanks!
    – 10 Rep
    Feb 1, 2021 at 17:32
0

I solved this problem by setting the withCredentials: true on my axios.post request to the logout route. I guess the required credentials to identify the session weren't being sent over so the req.logOut() had no effect (I also noticed that req.user was undefined on the log out route, which was a big clue)

0

I managed to resolve a similar problem by changing the code in my client where I made the request, replacing the following:

 const res = await axios.get("http://localhost:4000/auth/logout");

with this:

window.open("http://localhost:4000/auth/logout", "_self");

1
0

For me req.logout worked but I don't why req.logout() not working. How function call is not working

1
  • 1
    As it’s currently written, your answer is unclear. Please edit to add additional details that will help others understand how this addresses the question asked. You can find more information on how to write good answers in the help center.
    – Community Bot
    Jul 10, 2022 at 15:46
0

I do this

window.open(http://localhost:4000/auth/logout, "_self");

in the function before window.open call to e.preventDefault()

this is recommended because when you do click in log out Button you refresh the page, and the function isn't call it

function logout(e) { e.preventDefault() window.open(http://localhost:4000/auth/logout, "_self"); }

3 January 2022

1
  • 1
    Your answer could be improved with additional supporting information. Please edit to add further details, such as citations or documentation, so that others can confirm that your answer is correct. You can find more information on how to write good answers in the help center.
    – Community Bot
    Jan 3, 2023 at 10:52
0

Try to change your method from POST to DELETE on your /logout route.

app.delete('/logout', (req, res, next) => {
 req.logOut((err) => {
  if (err) return next(err);
  return res.redirect('/');
 });
});
0
req.logOut()

and

req.logOut()

didn't worked for me.

For me this worked just fine:

router.get('/logout', (req, res) => {
  req.session.destroy();
  req.cookies = null;
 res.json({message: 'Logged out'})
});
-1

You shoulde be using req.logout() to destroy the session in the browser.

app.get('/logout', function(req, res) {
    req.logout();
    res.redirect('/'); // whatever the route to your default page is
});
-3

I don't know how but ng-href="/signout" solved my problem. Previously I have used service to logout, but instead I've used it directly.

1
  • 1
    I'm not using Angular so this doesn't make any sense. :/
    – IIllIIll
    May 19, 2016 at 17:12
-3

In my case, using a callback passed to req.session.destroy helped only some of the time and I had to resort to this hack:

req.session.destroy();
setTimeout(function() {
    res.redirect "/";
}, 2000);

I don't know why that's the only solution that I've been able to get to work, but unfortunately @JulianLloyd's answer did not work for me consistently.

It may have something to do with the fact that my live login page uses SSL (I haven't been able to reproduce the issue on the staging site or my localhost). There may be something else going on in my app too; I'm using the derby-passport module since my app is using the Derby framework, so it's difficult to isolate the problem.

It's clearly a timing issue because I first tried a timeout of 100 ms, which wasn't sufficient.

Unfortunately I haven't yet found a better solution.

2
  • why delay of 2 seconds, when you can use an asynchronous callback
    – Godfather
    Jun 18, 2016 at 18:54
  • The callback was not firing consistently for me. Jun 19, 2016 at 19:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.