Be part of JetBrains PHPverse 2026 on June 9 – a free online event bringing PHP devs worldwide together.

Yokovaski's avatar

Override Spark authentication in order to receive the password of the authenticated user.

Hi everyone,

During the login process of Spark I need to be able to request a token of a remote API. This API stores the exact same users and passwords as the Laravel Spark application. Therefore I need to get the username and non hashed password of the user during the authentication process.

I thought overriding the authenticated method would be the solution to my problem. In routes/web.php I override the POST /login endpoint and am pointing this endpoint to my own LoginController:

<?php

namespace App\Http\Controllers\Auth;

use Illuminate\Support\Facades\Log;
use Illuminate\Http\Request;
use Laravel\Spark\Http\Controllers\Auth\LoginController as SparkLoginController;

class LoginController extends SparkLoginController
{
    /**
     * Create a new login controller instance.
     *
     * @return void
     */
    public function __construct()
    {
        parent::__construct();
    }

    /**
     * Handle a successful authentication attempt.
     *
     * @param  Request  $request
     * @param  \Illuminate\Contracts\Auth\Authenticatable  $user
     * @return Response
     */
    public function authenticated(Request $request, $user)
    {
        Log::info('authenticated method in LoginController has been called');

        return parent::authenticated($request, $user);
    }
}

This implementation throws a Missing argument 2 for App\Http\Controllers\Auth\LoginController::authenticated() exception. Somehow Laravel is not passing a User in the $user parameter. This exception is thrown whatever I do. Even removing the method out of my LoginController will result in the same exception thrown in the Spark LoginController.

0 likes
3 replies
martinbean's avatar

@Yokovaski You should not be accessing users’ passwords in plain text. This is a massive security flaw.

Yokovaski's avatar

@martinbean Thanks, I know that. Therefore I want to alter the authentication process of Laravel Spark. The method to login will receive the non hashed password before it can be compared to the stored hash of the password.

I do not want to access a plain text password in any other way than is implemented by default. That's why I want to override the authenticated() method, because $request contains the email and password of the authenticated user.

Yokovaski's avatar
Yokovaski
OP
Best Answer
Level 1

It turned out that my POST /login route did not call the right function. It called Auth\LoginController@authenticated and it should call Auth\LoginController@login.

How the complete route should look:

Route::post('/login', 'Auth\LoginController@login');

Stupid mistake, but maybe it will help someone in the future facing the same problem.

Please or to participate in this conversation.