Laravel Sanctum AuthenticateSession middleware issue
So I'm trying to implement an impersonate feature in my application. The frontend is in angular and I'm using the auth sanctum for authentication using cookie as session driver. My code snippets are as below.
public function impersonate(Request $request)
{
$user = $request->user();
if (!$user->is_super) abort(500);
Auth::guard('web')->loginUsingId(request('id'));
$request->session()->regenerate();
return response()
->json(['message' => 'Impersonated successfully.'])
->withCookie(cookie()->forever('original_user', $user->id));
}
public function logout(Request $request)
{
if ($id = $request->cookie('original_user')) {
Auth::guard('web')->logout();
$request->session()->invalidate();
$request->session()->regenerateToken();
Auth::guard('web')->loginUsingId($id);
$request->session()->regenerate();
return response()->noContent()->withCookie(cookie()->forget('original_user'));
} else {
Auth::guard('web')->logout();
$request->session()->invalidate();
$request->session()->regenerateToken();
return response()->noContent();
}
}
The impersonate function gives a successful response for all users.
The problem is that for created users the server responds with 'Unauthenticated' error with the new cookie values. However, for seeded users it works just fine.
When I turn off the 'authenticate_session' middleware in sanctum.php config, it all seems to work just fine for all users.
For now I've turned off 'authenticate_session'. I just want to know why this is happening.
In the frontend, I'm using the default angular http client with {withCredentials: true} header options.
Please or to participate in this conversation.