How to handle session timeout in Laravel 9 application?

One solution to handle session timeout in Laravel 9 application is to use Laravel's built-in middleware called "AuthenticateSession". This middleware checks if the user's session is still valid and if not, it logs out the user and redirects them to the login page.

To use this middleware, you can add it to the "web" middleware group in your "app/Http/Kernel.php" file:

protected $middlewareGroups = [
    'web' => [
        // ...
        \Illuminate\Session\Middleware\AuthenticateSession::class,
    ],
    // ...
];

Once you have added this middleware, you can create a custom middleware that checks if the user's session has timed out and redirects them to a "session timed out" page. Here's an example of how you can do this:

<?php

namespace App\Http\Middleware;

use Closure;
use Illuminate\Support\Facades\Auth;

class CheckSessionTimeout
{
    public function handle($request, Closure $next)
    {
        if (Auth::check() && ! $request->session()->has('lastActivityTime')) {
            $request->session()->put('lastActivityTime', time());
        }

        $maxIdleTime = config('session.lifetime') * 60;

        if (Auth::check() && $request->session()->has('lastActivityTime') && (time() - $request->session()->get('lastActivityTime') > $maxIdleTime)) {
            Auth::logout();

            return redirect('/session-timeout');
        }

        $request->session()->put('lastActivityTime', time());

        return $next($request);
    }
}

In this middleware, we first check if the user is authenticated and if the "lastActivityTime" session variable is not set, we set it to the current time. We then calculate the maximum idle time based on the session lifetime configuration value and check if the user has been idle for longer than this time. If so, we log them out and redirect them to the "session-timeout" page. Finally, we update the "lastActivityTime" session variable to the current time.

To use this middleware, you can add it to the "web" middleware group in your "app/Http/Kernel.php" file:

protected $middlewareGroups = [
    'web' => [
        // ...
        \App\Http\Middleware\CheckSessionTimeout::class,
    ],
    // ...
];

You can then create a "session-timeout.blade.php" view file and a route that points to it:

Route::get('/session-timeout', function () {
    return view('session-timeout');
});

Now, whenever the user's session times out, they will be automatically logged out and redirected to the "session-timeout" page. You can also customize this behavior by modifying the middleware or the view file as needed.