User does not stay logged in after Auth:validate was true

user_12983786 0
Viewed 72

i'm trying to develop a multi tenant, app in laravel, with multiple DBs and subdomains, so far i'm using the default user guard for authenticating in the main domain let's say it's example.com, it works fine, i'm also using a different guard for the subdomains, registration works fine, but the login seems to be broken, it authenticates the user but if i try to Auth:user() or even redirect to a protected route it looks like the user has already logged out.

I'm using relational database as the session driver (to avoid subdomains user to modify the cookies domain and access other subdomains), the sessions seems to be stored correctly in the sessions table of the main domain, but in the subdomain every record has the user_id set as null.

Here is my config/auth.php file


    'guards' => [
        'web' => [
            'driver' => 'session',
            'provider' => 'users',
        ],

        'api' => [
            'driver' => 'token',
            'provider' => 'users',
            'hash' => false,
        ],

        // this is the guard for subdomains

        'collaboratore' => [
            'driver' => 'session',
            'provider' => 'collaboratori',
        ],
    ],

    /*
    |--------------------------------------------------------------------------
    | User Providers
    |--------------------------------------------------------------------------
    */
    'providers' => [
        'users' => [
            'driver' => 'eloquent',
            'model' => App\Models\User::class,
        ],

        'collaboratori' => [
            'driver' => 'eloquent',
            'model' => App\Models\Collaboratore::class,
        ],

this is my model for users in the subdomains


namespace App\Models;

use Illuminate\Database\Eloquent\Factories\HasFactory;
use Illuminate\Foundation\Auth\User as Authenticatable;
use Illuminate\Notifications\Notifiable;

class Collaboratore extends Authenticatable
{
    use HasFactory, Notifiable;

    protected $table = 'collaboratore';
    protected $guard = 'collaboratore';
    public $primaryKey = 'id';
    
    /**
     * The attributes that are mass assignable.
     *
     * @var array
     */
    protected $fillable = [
        'username',
        'password',
        'email',
        // ... other stuff ...

    ];

    /**
     * The attributes that should be hidden for arrays.
     *
     * @var array
     */
    protected $hidden = [
        'password',
        'remember_token',
    ];

    /**
     * The attributes that should be cast to native types.
     *
     * @var array
     */
    protected $casts = [
        'email_verified_at' => 'datetime',
    ];
}

and this is my controller for users in the subdomains

public function login(Request $request )
    {
        // validate request
        $credentials = $this->validate($request, [
            'email' => 'required|email',
            'password' => 'required'
        ]);

        if ( Auth::guard('collaboratore')->attempt( $credentials ) )
        {
            // login successful
            return redirect('/home');
        }
        //dd("failed");
        // login failed
        return $request->expectsJson()
            ? response([ 'message' => 'Invalid credentials', 401 ])
            : redirect()->back()->withInput($request->only('email', 'remember'));

    }

any help would be appreciated, i'm kinda stuck right now

laravel multi-tenant authentication php
2 Answers

From Laravel website https://laravel.com/docs/8.x/authentication#introduction

The attempt method is normally used to handle authentication attempt's from your application's "login" form. If authentication is successful, you should regenerate the user's session to prevent session fixation:

    if (Auth::attempt($credentials)) {
        $request->session()->regenerate();

        return redirect()->intended('dashboard');
    }

So you should add $request->session()->regenerate(); inside your if attempt.

user_42640170

it looks like i managed to solve his, the problem was here, i changed

public function __construct()
    {
        $this->middleware('guest')->except('logout');
    }

to this

public function __construct()
    {
        $this->middleware('web');
    }

and now it's working, but the session is still note being stored

user_129837860
Related