diff --git a/security.rst b/security.rst
index d38c9cf731d..6d5cd1b98dc 100644
--- a/security.rst
+++ b/security.rst
@@ -1796,7 +1796,7 @@ To enable logging out, activate the ``logout`` config parameter under your fire
main:
# ...
logout:
- path: app_logout
+ path: /logout
# where to redirect after logout
# target: app_any_route
@@ -1817,11 +1817,10 @@ To enable logging out, activate the ``logout`` config parameter under your fire
-
-
+
@@ -1838,68 +1837,58 @@ To enable logging out, activate the ``logout`` config parameter under your fire
$mainFirewall = $security->firewall('main');
// ...
$mainFirewall->logout()
- // the argument can be either a route name or a path
- ->path('app_logout')
+ ->path('/logout')
// where to redirect after logout
// ->target('app_any_route')
;
};
-Next, you need to create a route for this URL (but not a controller):
+Symfony will then un-authenticate users navigating to the configured ``path``,
+and redirect them to the configured ``target``.
-.. configuration-block::
-
- .. code-block:: php-attributes
+.. tip::
- // src/Controller/SecurityController.php
- namespace App\Controller;
+ If you need to reference the logout path, you can use the ``_logout_``
+ route name (e.g. ``_logout_main``).
- use Symfony\Bundle\FrameworkBundle\Controller\AbstractController;
- use Symfony\Component\Routing\Annotation\Route;
+If your project does not use :ref:`Symfony Flex `, make sure
+you have imported the logout route loader in your routes:
- class SecurityController extends AbstractController
- {
- #[Route('/logout', name: 'app_logout', methods: ['GET'])]
- public function logout(): never
- {
- // controller can be blank: it will never be called!
- throw new \Exception('Don\'t forget to activate logout in security.yaml');
- }
- }
+.. configuration-block::
.. code-block:: yaml
- # config/routes.yaml
- app_logout:
- path: /logout
- methods: GET
+ # config/routes/security.yaml
+ _symfony_logout:
+ resource: security.route_loader.logout
+ type: service
.. code-block:: xml
-
+
-
+
.. code-block:: php
- // config/routes.php
+ // config/routes/security.php
use Symfony\Component\Routing\Loader\Configurator\RoutingConfigurator;
- return function (RoutingConfigurator $routes): void {
- $routes->add('app_logout', '/logout')
- ->methods(['GET'])
- ;
+ return static function (RoutingConfigurator $routes): void {
+ $routes->import('security.route_loader.logout', 'service');
};
-That's it! By sending a user to the ``app_logout`` route (i.e. to ``/logout``)
-Symfony will un-authenticate the current user and redirect them.
+.. versionadded:: 6.4
+
+ The :class:`Symfony\\Bundle\\SecurityBundle\\Routing\\LogoutRouteLoader` was
+ introduced in Symfony 6.4.
Logout programmatically
~~~~~~~~~~~~~~~~~~~~~~~
@@ -1989,6 +1978,105 @@ to execute custom logic::
}
}
+Customizing Logout Path
+~~~~~~~~~~~~~~~~~~~~~~~
+
+Another option is to configure ``path`` as a route name. This can be useful
+if you want logout URIs to be dynamic (e.g. translated according to the
+current locale). In that case, you have to create this route yourself:
+
+.. configuration-block::
+
+ .. code-block:: yaml
+
+ # config/routes.yaml
+ app_logout:
+ path:
+ en: /logout
+ fr: /deconnexion
+ methods: GET
+
+ .. code-block:: xml
+
+
+
+
+
+
+ /logout
+ /deconnexion
+
+
+
+ .. code-block:: php
+
+ // config/routes.php
+ use Symfony\Component\Routing\Loader\Configurator\RoutingConfigurator;
+
+ return function (RoutingConfigurator $routes): void {
+ $routes->add('app_logout', [
+ 'en' => '/logout',
+ 'fr' => '/deconnexion',
+ ])
+ ->methods(['GET'])
+ ;
+ };
+
+Then, pass the route name to the ``path`` option:
+
+.. configuration-block::
+
+ .. code-block:: yaml
+
+ # config/packages/security.yaml
+ security:
+ # ...
+
+ firewalls:
+ main:
+ # ...
+ logout:
+ path: app_logout
+
+ .. code-block:: xml
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ .. code-block:: php
+
+ // config/packages/security.php
+ use Symfony\Config\SecurityConfig;
+
+ return static function (SecurityConfig $security): void {
+ // ...
+
+ $mainFirewall = $security->firewall('main');
+ // ...
+ $mainFirewall->logout()
+ ->path('app_logout')
+ ;
+ };
+
.. _retrieving-the-user-object:
Fetching the User Object