MEN Stack Session Auth Sign Users Out

Learning objective: By the end of this lesson, students will be able to implement user sign out functionality by deleting a session.

Signing the user out

Now that we’re creating sessions when users sign in, we can simply delete those sessions when a user wants to sign out.

Let’s start by adding a link on the landing page for users to sign out. We only want to show this link if there is a currently signed in user, so we should put it inside the same conditional that displays that user’s username.

In views/index.ejs:

<% if (user) { %>
<h1>Welcome to the app, <%= user.username %>!</h1>
<p>
  <!-- new sign out link -->
  <a href="/auth/sign-out">Sign out</a>
</p>
<% } else { %>
<h1>Welcome to the app, guest.</h1>
<p>
  <a href="/auth/sign-up">Sign up</a> or <a href="/auth/sign-in">Sign in</a>.
</p>
<% } %>

Define the route

The sign out link will send a GET request to /auth/sign-out, so we should prepare to accept that request in the auth controller. Let’s set up a minimal route with a res.send for testing purposes.

Add the following to /controllers/auth.js:

router.get("/sign-out", (req, res) => {
  res.send("The user wants out!");
});

To sign a user out, we need to get rid of the session attached to the req object. Lucky for us, the express session object has a built-in method conveniently named destroy, allowing us to easily delete the session using req.session.destroy(). Nice!

After signing out, most applications will redirect the user back to the landing page, so let’s do just that.

The final controller method should look like this:

router.get("/sign-out", (req, res) => {
  req.session.destroy();
  res.redirect("/");
});

Testing the sign out functionality

That’s all there is to it! We should be able to manually test the application by signing in, seeing our username on the landing page, and clicking the sign out link to be returned to the landing page as an anonymous guest. You can also validate this by seeing whether the sign in and sign up links are present.