title: cakephp 3 and logout confusion
body: <p>I'm having some trouble wrapping my head around whether or not things are working as intended.</p>
  
  <p>I've got a simple implementation of cakephp3, cake-auth0 (<a href="https://github.com/jsoftb/auth0" rel="nofollow noreferrer">https://github.com/jsoftb/auth0</a>) and I am using an auth0 login form.</p>
  
  <p>This flow works just fine.</p>
  
  <p><em>example.com/users/login -> form -> my-domain.auth0.com -> example.com/users/login?code=secret</em></p>
  
  <pre><code>$auth_code = $this-&gt;request-&gt;query('code', null);
  if(!is_null($auth_code)) {
    $user = $this-&gt;Auth-&gt;identify();
    if($user) {
      $this-&gt;Auth-&gt;setUser($user);
      return $this-&gt;redirect($this-&gt;Auth-&gt;redirectUrl()); // example.com/
    }
  }
  </code></pre>
  
  <p>Logging a user out is where I'm having issues.</p>
  
  <p><em>example.com/users/logout -> auth0-domain (kill cookie) -> example.com</em></p>
  
  <pre><code>public function logout() {
    return $this-&gt;redirect($this-&gt;Auth-&gt;logout());
    // $this-&gt;redirect('http://auth0.domain?returnTo=http://example.com/');
  }
  public function beforeFilter(Event $event) {
    parent::beforeFilter($event);
    $this-&gt;Auth-&gt;allow('logout'); // Appears to do nothing
  }
  </code></pre>
  
  <p>This successfully logs me in and out of auth0 just fine.
  I stay logged into cake however and it is driving me a bit batty.
  My login page with some session user output shows me as logged in and I can access the page example.com/users. I cannot view it while not yet logged in.</p>
  
  <p>I haven't created any database stuff to go with users yet if that helps.</p>
  
  <p>Short of going brutal and nuking all sessions/cookies using just php, anyone else have any ideas?</p>
  
  <hr>
  
  <p><em>Update:</em> Dug a lot through code. Cake's vanilla Authcomponent::logout doesn't do much of anything. I managed to get something that will work for me by manually killing <em>a</em> session of some sort.</p>
  
  <p>I'll leave this up because I know some guru will come along at some point.</p>
  
  <p>I was able to achieve logging out (of cake) like this:</p>
  
  <pre><code>public function logout() {
    $url = $this-&gt;Auth-&gt;logout();
    $this-&gt;request-&gt;session()-&gt;destroy();
    return $this-&gt;redirect($url);
  }
  </code></pre>
  
  <p>Call AuthComponent's logout function and save the response url string.</p>
  
  <p>Destroy the request session because logout didn't do it.</p>
  
  <p>Redirect.</p>