基于会话令牌认证问题的Laravel 5.6购物车

我找到了一个有效的解决方案。我修改了LoginController并根据需要更新了sendLoginResponse方法:

protected function sendLoginResponse(Request $request)
    {
        // save old session token (shopping cart is related to this one)

        $old_session_token = session()->get('_token');

        // regenerate new session (prevent session fixation)
        $request->session()->regenerate();

        // get new session token
        $new_session_token = session()->get('_token');

        // update session token in cart table

        $shopping_cart = Cart::where('session_token', $old_session_token)->first();

        $shopping_cart->session_token = $new_session_token;

        $shopping_cart->save();

        $this->clearLoginAttempts($request);

        return $this->authenticated($request, $this->guard()->user())
            ?: redirect()->intended($this->redirectPath());
    }

此代码用新令牌更新旧令牌。

尝试登录之前的主idea安全旧会话id

1. 更改路由中的操作名称

   Route::post("/login", 'LoginController@doLogin');
   

2. 修改LoginController

   class LoginController extends Controller {
   
      use AuthenticatesUsers;
   
      private $old_session_id;
   
      public function doLogin(Request $request) {
        //remember old session id
        $this->old_session_id = $request->session()->getId();
   
        //call AuthenticatesUsers trait method
        return $this->login($request);
      }
   
      //override trait method
      protected function authenticated(Request $request, $user) {
         //sync cart
         $cart = Cart::whereSessionId($this->old_session_id)->first();
      }
   
   }