Skip to content

Commit 0a6659a

Browse files
skyosevbarryvdh
authored andcommitted
Fix session destroy when using multiple guards (barryvdh#948)
Related to barryvdh#856 It seems the recaller logic is outdated as it leads to session destroy (and thus csrf token regeneration) when using multi-auth. It fails to retrieve the guard from the cookie, which leads to $guard->user() call and session migration.
1 parent bda348f commit 0a6659a

File tree

1 file changed

+5
-9
lines changed

1 file changed

+5
-9
lines changed

src/DataCollector/MultiAuthCollector.php

Lines changed: 5 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -81,18 +81,14 @@ private function resolveUser(Guard $guard)
8181
// if we're logging in using remember token
8282
// then we must resolve user „manually”
8383
// to prevent csrf token regeneration
84-
84+
8585
$recaller = $guard instanceof SessionGuard
86-
? $guard->getRequest()->cookies->get($guard->getRecallerName())
86+
? new Recaller($guard->getRequest()->cookies->get($guard->getRecallerName()))
8787
: null;
8888

89-
if (is_string($recaller) && Str::contains($recaller, '|')) {
90-
$segments = explode('|', $recaller);
91-
if (count($segments) == 2 && trim($segments[0]) !== '' && trim($segments[1]) !== '') {
92-
return $guard->getProvider()->retrieveByToken($segments[0], $segments[1]);
93-
}
94-
}
95-
return $guard->user();
89+
return !is_null($recaller) && !is_null($user = $this->provider->retrieveByToken(
90+
$recaller->id(), $recaller->token()
91+
)) ? $user : $guard->user();
9692
}
9793

9894
/**

0 commit comments

Comments
 (0)