Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix user not being able to logout #507

Closed

Conversation

GigaGiorgadze
Copy link
Contributor

issue description: when user logins as user A and then logs out and tries to login as user B they can not send request to route protected by auth:sanctum middleware

how to reproduce: i prepared two repositories (back, front) for reproducing, all you have to do is install backend and frontend repositories, following install guideline in the readme and then press buttons on frontend in following order: login gmail. fetch me, logout, login redberry, fetch me. this second "fetch me" should return 401 without this fix applied. instead of going and changing vendor i crated custom middleware which implements same fix so you can just replace 'authenticate_session' in config/sanctum.php with this 'authenticate_session' => App\Http\Middleware\AuthenticateSanctumRequest::class, and issue will be fixed

video proof without fix:
https://github.com/laravel/sanctum/assets/75663118/b647e4f5-9d87-4e79-bce4-bd8bfb9599d5

video proof with fix:

simplescreenrecorder-2024-04-06_14.50.36.mp4

i believe this issue was caused because user was grabbed from the request even though user was logged out during that request. using auth guard to grab it from current session seemed to fix it

Copy link

github-actions bot commented Apr 6, 2024

Thanks for submitting a PR!

In order to review and merge PRs most efficiently, we require that all PRs grant maintainer edit access before we review them. For information on how to do this, see the relevant GitHub documentation. Additionally, GitHub doesn't allow maintainer permissions from organization accounts. Please resubmit this PR from a personal GitHub account with maintainer permissions enabled.

@github-actions github-actions bot closed this Apr 6, 2024
@GigaGiorgadze GigaGiorgadze deleted the fix/unable-to-logout branch April 6, 2024 10:57
@GigaGiorgadze GigaGiorgadze restored the fix/unable-to-logout branch April 6, 2024 10:58
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

1 participant