template = https://media.pragprog.com/titles/{book_id}/code/{listing_title}
book_id = phoenix14
listing_title = authentication/listings/rumbl/lib/rumbl_web/controllers/session_controller.change2.ex

https://media.pragprog.com/titles/phoenix14/code/authentication/listings/rumbl/lib/rumbl_web/controllers/session_controller.change2.ex

If you use:

  # in rumbl/lib/rumbl_web/controllers/session_controller.ex
  def delete(conn,_) do
    IO.puts("RumblWeb.SessionController.delete: #{inspect(Routes.page_path(conn, :index))}")

    conn
    |> RumblWeb.Auth.logout()
    |> redirect(to: Routes.page_path(conn, :index))
  end

You should see this in the server console

RumblWeb.SessionController.delete: "/"

when you log out.

Phoenix.Controller.redirect/2

Sends redirect response to the given url.

So what is happening is that redirect/2 is instructing the browser to request “/” - the index page prepared by page_controller.ex.

The conn structure used for RumblWeb.PageController.index/2 is a fresh, new value. Whatever you put into the conn before the HTTP redirection has been lost …

https://media.pragprog.com/titles/phoenix14/code/authentication/listings/rumbl/lib/rumbl_web/controllers/auth.change2.ex

  def logout(conn) do
    configure_session(conn, drop: true)
  end

Plug.Conn.configure_session/2

• :drop - drops the session, a session cookie will not be included in the response

… and in the absence of a session nothing carries over from one request to the next.

don’t uses the clear_session(conn)

Plug.Conn.clear_session/1

Note that, even if clear_session/1 is used, the session is still sent to the client. If the session should be effectively dropped , configure_session/2 should be used with the :drop option set to true .

i.e. given that the session is being dropped, clearing it is redundant.

In which cases this will serve for example?

Now change to this:

  # from rumbl/lib/rumbl_web/controllers/auth.ex
  def logout(conn) do
    delete_session(conn, :user_id)
    # configure_session(conn, drop: true)
  end

and this

  # in rumbl/lib/rumbl_web/controllers/session_controller.ex
  def delete(conn,_) do
    conn
    |> RumblWeb.Auth.logout()
    |> put_flash(:info, "Bye, Bye!")
    |> redirect(to: Routes.page_path(conn, :index))
  end

and you will see the flash info on the index page when you log out.

Plug.Conn.delete_session/2 simply deletes the value associated with the :user_id key from the session - but the rest of the session and all the other data in it remains - which is why now the flash info can carry over to the index page.