المصادقة ودورة حياة الجلسة

<?php
namespace App\Http\Controllers;
use Illuminate\Http\Request;
use Illuminate\Http\RedirectResponse;
use Illuminate\Support\Facades\Auth;
class LoginController extends Controller
{
    public function store(Request $request): RedirectResponse
    {
        $credentials = $request->validate([
            "email" => ["required", "email"],
            "password" => ["required", "string"],
        ]);
        if (Auth::guard("web")->attempt($credentials)) {
            $request->session()->regenerate();
            return redirect()->intended("/dashboard");
        }
        return back()->withErrors(["email" => "The provided credentials are invalid."])
            ->withInput($request->only("email"));
    }
}

Valid isolated credentials: authenticated web session then intended redirect. Invalid credentials: email error and no password flash.

يتطلب POST محميا ومحدد محاولات ومخزن جلسة ومستخدما مصطنعا مجزأ. يدور النجاح الجلسة ولا يعيد الفشل كلمة السر.

<?php
namespace App\Http\Controllers;
use Illuminate\Http\Request;
use Illuminate\Http\RedirectResponse;
use Illuminate\Support\Facades\Auth;
class LogoutController extends Controller
{
    public function destroy(Request $request): RedirectResponse
    {
        Auth::guard("web")->logout();
        $request->session()->invalidate();
        $request->session()->regenerateToken();
        return redirect("/");
    }
}

After isolated logout, a subsequent protected web request follows the guest-access contract.

اربطه بخروج POST وCSRF العادية؛ ينهي الجلسة الحالية لا كل رمز وجهاز.