CakePHP logoutRedirect is not the same as loginAction

If you go through the CakePHP Auth example tutorial, you’ll end up with two (not three) configuration settings in your AppController > components > Auth settings. They will look like this:

public $components = array(
        'Session',
        'Auth' => array(
            'loginRedirect' => array('controller' => 'posts', 'action' => 'index'),
            'logoutRedirect' => array('controller' => 'pages', 'action' => 'display', 'home')
        )
    );

I unconsciously made the incorrect assumption that “logoutRedirect” would always take you to the login page. You log out.

You get redirected to the login page. But when I put my carefully crafted login page at pages/home. Yet when I visited my site without a proper cookie, I wasn’t redirected to pages/home. I was redirected to users/login. Where the heck was that coming from?

Turns out there is another AppController > components > Auth setting that specifies where the login action is found. When you add it to your other components, it will look like this:

public $components = array(
        'Session',
        'Auth' => array(
            'loginAction' => array('controller' => 'pages', 'action' => 'display', 'home'),
            'loginRedirect' => array('controller' => 'posts', 'action' => 'index'), 
            'logoutRedirect' => array('controller' => 'pages', 'action' => 'display', 'home') ) );

It seems that logoutRedirect is only used for where to go, immediately after logging out.

I wrote this post because a coworker had made the exact same assumption and mistake as I had.