php - Laravel 4.2 ajax request loop logs a user back in after logout -

i ran interesting bug took bit identify.

we have standard auth setup in place.

auth::check() see if logged in. if are, go dashboard. if aren't, take them login screen.

the dashboard view loops through several ajax calls fill in various sections of dashboard. discovered if user tries logout before ajax calls completed, redirected on dashboard , still logged in (i've verified go through logout process , auth::check() returns false).

if try , logout after ajax calls complete (or if disable ajax calls), works expected , logged out , redirected login screen.

the basic structure is:

routes.php

route::get('/', array('as' => 'home', 'uses' => 'homecontroller@getindex'));  route::get('/login', array('as' => 'login', 'uses' => 'authcontroller@getlogin'))->before('guest'); route::post('/login', array( 'uses' => 'authcontroller@postlogin'))->before('csrf');  route::get('/logout', array('as' => 'logout','uses' => 'authcontroller@getlogout'))->before('auth');  route::get('/dashboard', array('as' => 'dashboard', 'uses' => 'dashboardcontroller@getindex'))->before('auth'); route::post('/dashboard/panel', array('as' => 'getpaneldata', 'uses' => 'dashboardcontroller@getdashboardpaneldata'))->before('auth'); /* /dashboard/panel recieves ajax call data , returns result */ 

homecontroller.php

class homecontroller extends basecontroller {      public function getindex()     {                if(auth::check()) {             return redirect::route('dashboard');         } else {             session::flush();             return redirect::route('login');         }            }  } 

dashboardcontroller.php

public function getindex() {     return view::make('layouts.dashboard.index'); }  public function getdashboardpaneldata() {    // gets data ajax call , returns result } 

i've thought couple of solutions, 1 being kill unfinished ajax requests when click logout button, or removing auth filter panels route, i'm unsure if first idea , i'm wary of latter security stand point.

edit:

you can ignore loop part in of this. if take loop out , run 1 ajax call, if log out in middle of ajax call still issue logs out , logs in again.

add. edit:

i tried removing auth filter on /dashboard/panel , doesn't fix problem.

edit:

here's auth filter, it's pretty standard.

route::filter('auth', function() {     if (auth::guest()) return redirect::guest('login'); }); 

partial solution: in case, dashboard panels don't require access authenticated user. did check path in session config , if matches dashboard panels, change session driver array (which won't rewrite file session, thereby allowing full logout).

in session.php:

'driver' => request::path() === 'dashboard/panel' ? 'array' : 'file', 

again, it's not ideal solution all, in case sufficient.

ajax calls should return 401 status code (unauthorized). attach event handler document , make redirection login page:

$(document).ajaxerror(function(event, xhr, settings, thrownerror) {     if(xhr.status == "401") {                    window.location.href = "/login";              }   }); 

edit: example of route filter:

route::filter('auth', function() {        if (auth::guest())  {         if (request::ajax()) {                       return response::json('permission_denied', 401);         }         else {             return redirect::guest('login');         }      }     });