Laravel Custom Guard Auth Attempt is not creating any session after login

I am using Laravel Livewire with custom guard multi-authentication. Here is the code for the login function: Guard name is seller

 public function login(){
        $credentials = [
            'mobile' => $this->mobile,
            'password' => $this->password,
        ];

        if(Auth::guard('seller')->attempt($credentials)){
            return $this->redirectRoute('sellerdashboard');
        }else{
            session()->flash('loginmsg', 'Login Failed! Invalid Mobile Number or Password');
        }
    }

Login is successful and the code working properly but after login auth is not creating any session and returning session data as null

dualklip

2 years ago

Level 2

Hi @learnwithmoin

Maybe you are missing the session generation itself. attempt tries to authenticate but only that. If you see the manual authenticate example in Laravel Documentation a call to $request->session()->regenerate(); must be done after successfully attempt.

<?php
 
namespace App\Http\Controllers;
 
use Illuminate\Http\Request;
use Illuminate\Http\RedirectResponse;
use Illuminate\Support\Facades\Auth;
 
class LoginController extends Controller
{
    /**
     * Handle an authentication attempt.
     */
    public function authenticate(Request $request): RedirectResponse
    {
        $credentials = $request->validate([
            'email' => ['required', 'email'],
            'password' => ['required'],
        ]);
 
        if (Auth::attempt($credentials)) {
            $request->session()->regenerate();
 
            return redirect()->intended('dashboard');
        }
 
        return back()->withErrors([
            'email' => 'The provided credentials do not match our records.',
        ])->onlyInput('email');
    }
}

When you install a new Laravel from scratch you can se how they give you the AuthenticatedSessionController with this method:

public function store(LoginRequest $request): RedirectResponse
    {
        $request->authenticate();

        $request->session()->regenerate();

        return redirect()->intended(route('dashboard', absolute: false));
    }

The attempt call is on the authenticate() method, if that success then $request->session()->regenerate() is called to create the session

1 like

LearnWithMoin

2 years ago

Level 1

@dualklip Currently I am using Laravel Livewire. I think it's an issue with Livewire 3. Because I don't find any issue in my laravel code.

dualklip

2 years ago

Level 2

Anyway I think is recomendable to regenerate the session in order to prevent session fixation

LearnWithMoin

2 years ago

Level 1

@dualklip Login is successful but isn't generating any authenticated session. Here is the code.

<?php

namespace App\Livewire;

use Illuminate\Http\Request;
use Livewire\Component;
use Livewire\Attributes\Title;
use Illuminate\Http\RedirectResponse;
use Illuminate\Support\Facades\Auth;
use App\Models\Seller as SellerModel;

class Seller extends Component
{
    #[title('Seller Login')]
    public function render(){
        return view('livewire.seller')->layout('layout.sellerlogin');
    }

    public $email;
    public $password;
   
    public function login(Request $request){
        $credentials = [
            'email' => $this->email,
            'password' => $this->password,
        ];

        if(Auth::guard('seller')->attempt($credentials)){
            $request->session()->regenerate();
            return redirect()->intended('seller/dashboard');
        }else{
            session()->flash('loginmsg', 'Login Failed! Invalid Email or Password');
        }
    }

    public function logout(){
        Auth::guard('seller')->logout();
        return redirect()->route('sellerlogin');
    }
}

dualklip

2 years ago

Level 2

@LearnWithMoin Is seller guard configured on config/auth.php file?

LearnWithMoin

2 years ago

Level 1

@dualklip Here is my seller guard in config/auth.php

<?php

return [

    'defaults' => [
        'guard' => env('AUTH_GUARD', 'web'),
        'passwords' => env('AUTH_PASSWORD_BROKER', 'users'),
    ],

    'seller' => [
        'guard' => env('AUTH_GUARD', 'seller'),
        'passwords' => env('AUTH_PASSWORD_BROKER', 'sellers'),
    ],



    'guards' => [
        'web' => [
            'driver' => 'session',
            'provider' => 'users',
        ],

        'seller' => [
            'driver' => 'session',
            'provider' => 'sellers',
        ],
    ],



    'providers' => [
        'users' => [
            'driver' => 'eloquent', 
            'model' => env('AUTH_MODEL', App\Models\User::class),
        ],
        'sellers' => [
            'driver' => 'eloquent', 
            'model' => env('AUTH_MODEL', App\Models\Seller::class),
        ],

        // 'users' => [
        //     'driver' => 'database',
        //     'table' => 'users',
        // ],
    ],



    'passwords' => [
        'users' => [
            'provider' => 'users',
            'table' => env('AUTH_PASSWORD_RESET_TOKEN_TABLE', 'password_reset_tokens'),
            'expire' => 60,
            'throttle' => 60,
        ],
        'sellers' => [
            'provider' => 'sellers',
            'table' => env('AUTH_PASSWORD_RESET_TOKEN_TABLE', 'password_reset_tokens'),
            'expire' => 60,
            'throttle' => 60,
        ],
    ],


    'password_timeout' => env('AUTH_PASSWORD_TIMEOUT', 10800),

];
~~

Please or to participate in this conversation.