Logging out

Signing out needs to finish the application's session work as well as any provider-side work. The client exposes logout(), but the current implementation has limitations that matter when adding a logout button.

The outgoing request

For an ordinary authenticated user, logout() creates new token-only SessionData and redirects to the provider with an encrypted action=logout message. The current source includes a TODO reporting ApplicationDeploymentNotFoundException in this flow.

The stored user data is replaced, so a subsequent client instance using that session will not restore it. However, the existing Authenticator instance retains its in-memory user until the request ends. This is particularly relevant if a custom redirect handler returns normally.

The provider return needs integration work

The sibling provider clears its own session and, unless given an encrypted redirectTo value, returns to the deployment's configured client URI with do=logout in the query string. The PHP client does not automatically handle do=logout; calling setReturnUri() also does not add the provider's encrypted redirectTo field.

Verify and complete that return route in your integration before presenting this as a working end-to-end logout flow. Avoid a return handler that starts logout() again and sends the browser around the same flow repeatedly.

Clearing application authentication locally

If the application needs a local sign-out route, it can remove the stored authentication data and end the request with a redirect:

<?php
require __DIR__ . "/auth.php";

// Run this after the application's normal POST and CSRF checks.
unset($_SESSION[Authwave\SessionData::class]);
header("Location: /", true, 303);
exit;

This example uses the native session setup from the Quick start guide. With a supplied session container, call its remove(SessionData::class) method instead.

Local sign-out does not clear the provider's session or sign the visitor out of other applications. The next login may therefore complete without asking for credentials again. Use the flow that matches the experience your application promises.

Development users

A user whose email equals Authenticator::FAKE_EMAIL takes a special branch in logout(): it removes the stored session data and unsets the in-memory user without redirecting. A fake user created with a different email follows the ordinary provider logout branch.

---

Continue with Provider links for the other provider URI helpers.