Right now the session data for anonymous (non-authenticated) users of my web application is not moved/assigned to the user once they log in or register.
For example: An anonymous user interacts with the application, creates some session data (say products in a shopping cart), then logs in/registers and then logs out, the session data is still accessible and is not moved/made inaccessible to the now unauthenticated user.
I am using file session driver (no database), perhaps someone could provide some example of what needs to be changed (I presume in Session config) in order to make any session data created by an anonymous user become assigned to and only accessible by this user once they authenticate by logging in or registering and only while the user is authenticated.
The requirement for this is because users of the application create unique objects (tied to their user_id) which are only persisted after payment when order processing runs. I store them in session until the user logs-in/registers and goes through with the final order step and only then are they persisted. So I absolutely can't have user specific objects retained in non-authenticated sessions after the user logs out. I could flush the session on logout, but ideally I want to keep them for when the user logs back in.