To demonstrate this next new feature in Laravel 5.6, let's quickly scaffold an authentication system. There we go. So if I now visit laravel56.test, we now see the links to login and register. So I will quickly create an account here, password and password, and we're now signed in. Next, let's switch over to Safari and do the exact same thing. I will log in as John with my password. Okay, so at this point, think of this as two different people, even on opposite sides of the world, are logged into the same account.

Now first, to prove it to you, if I log out in Safari, and I switch over to Chrome and give this a refresh, well naturally on this account and in this session, we're still signed in. Okay, let's fix that. So one more time, log back in, and we're going to switch to Sublime, and I'm just going to set up a dummy route here, but you can have this wherever you want. Maybe you even want it on your LoginController. So when a User logs in, well maybe as part of that, you instantly want to invalidate any other existing sessions. That would be perfectly fine.

any other existing sessions. That would be perfectly fine. Or maybe there's just a form or a button the user clicks, whatever you want. We're going to simulate that with a simple, you probably won't post, but a simple GET request will do, and we'll call this LogoutOthers. Now added to the session guard is a new method called LogoutOtherDevices, you'll find it right here. And this will be the same class where you call login or loginUsingId or logout, okay? Let's take a look at LogoutOtherDevices. It's really simple.

Let's take a look at LogoutOtherDevices. It's really simple. All it does is it creates a new hash for the password and saves it, and that will invalidate any of the other sessions as a result. So we can see when you call this method, you do need to give your existing password. So then, Laravel will create a brand new hash, and that will be unique. Remember, for the same password, you can construct multiple hashes. So if I were to say bcrypt foobar and do it a bunch of times, well, you'll notice, take a look at the end, in every case, you're getting a unique hash. But all of those will equate to foobar when compared or checked.

take a look at the end, in every case, you're getting a unique hash. But all of those will equate to foobar when compared or checked. So now you might be wondering, well, I don't get it. We just updated a database column and saved it. How does that invalidate the other sessions? Well, take a look at this. We're going to now go into our Kernel.php, and if I scroll down, you'll see a web middleware with this one commented out, authenticateSession. All right, let's add that and quickly take a look at it. And the handle method, all right, well, if we don't have a User or no session, just immediately

All right, let's add that and quickly take a look at it. And the handle method, all right, well, if we don't have a User or no session, just immediately move on to the next request in the next layer of the onion. But if here, if the User is signed in and they clicked on that remember me checkbox, you'll notice we're getting the password hash and are comparing that against the User's password. And because we called this method that updated the hash, well, those will no longer equate. So if they are not the same, we will log out the other device, and that's basically what you need to know here. All right, I think we're ready to give this a shot.

you need to know here. All right, I think we're ready to give this a shot. So when we call logOutOtherDevices, we will say Auth::logOutOtherDevices. And again, at this point, you need to accept the user's password in some form. You of course don't want to store their actual password in the database. So this could be something where you prompt the user to type in their password before invalidating any other sessions. And again, that's why I recommend maybe when the user logs in on a new machine, well, at that point, you have their password, so you can use that to invalidate or log out the other sessions.

that point, you have their password, so you can use that to invalidate or log out the other sessions. In this case, I'm just going to hard code password here. Finally, we will redirect to the homepage. All right, so we're all set. So we'll go back to Chrome, refresh. We are signed in in Chrome, as well as Safari. On Safari, I will now hit this log out others endpoint. Okay, so the important thing to understand here is logOutOtherDevices, that method will invalidate the other devices, not this one.

So I think you might find, especially for things like SaaS apps or subscription sites where you want a little protection to make sure people aren't abusing their credentials, things like that. Well, in those situations, the logoutOtherDevices method will be precisely what you need.