Be part of JetBrains PHPverse 2026 on June 9 – a free online event bringing PHP devs worldwide together.

NoobDev's avatar

When should i regenerate session id ?

I've seen that by using a manual login is recommended regenerate the session id; same stuff for the logout route. Should I regenerate it even after user registration that logs in immediately the user in through Auth::loginUsingId() ? And by the way, are there other cases when the session should be regenerated ?

0 likes
3 replies
jlrdw's avatar

If manual, I would suggest just follow the documentation here:

https://laravel.com/docs/8.x/authentication#authenticating-users

Taylor regenerates session:

<?php

namespace App\Http\Controllers;

use Illuminate\Http\Request;
use Illuminate\Support\Facades\Auth;

class LoginController extends Controller
{
    /**
     * Handle an authentication attempt.
     *
     * @param  \Illuminate\Http\Request  $request
     * @return \Illuminate\Http\Response
     */
    public function authenticate(Request $request)
    {
        $credentials = $request->validate([
            'email' => ['required', 'email'],
            'password' => ['required'],
        ]);

        if (Auth::attempt($credentials)) {
            $request->session()->regenerate();   <------HERE

            return redirect()->intended('dashboard');
        }

        return back()->withErrors([
            'email' => 'The provided credentials do not match our records.',
        ]);
    }
}

Just do like Taylor did.

NoobDev's avatar

@jlrdw Hi, thanks for your reply; that's what I did... I would like to know if I should put the regenerate in my register aswell

       Auth::loginUsingId($user->id);

			//here

       return $this->success(['Registration success']);
    
Snapey's avatar

No need to do it on registration.

Maybe on password change.

Please or to participate in this conversation.