mirror of
https://github.com/HolgerHatGarKeineNode/einundzwanzig-app.git
synced 2026-05-05 04:54:53 +00:00
✨ **Nostr Login:** Improved CSRF token handling during login flow.
- 🛡️ Avoided redundant `Session::regenerate` call as `Auth::loginUsingId` already updates the session ID. - 🚀 Replaced `wire:navigate` with a full-page redirect to ensure a fresh CSRF token for Livewire actions.
This commit is contained in:
@@ -137,13 +137,19 @@ class extends Component {
|
||||
]);
|
||||
}
|
||||
FetchNostrProfileJob::dispatch($user);
|
||||
// Auth::loginUsingId() already regenerates the session id (see
|
||||
// SessionGuard::updateSession), so an explicit Session::regenerate()
|
||||
// would just rotate the CSRF token a second time. We also avoid
|
||||
// wire:navigate here: it preserves the <meta name="csrf-token"> tag
|
||||
// from the previous page, so any subsequent Livewire action on the
|
||||
// destination would 419 (TokenMismatch). A full-page redirect gives
|
||||
// the browser a fresh document with a fresh token.
|
||||
Auth::loginUsingId($user->id);
|
||||
Session::regenerate();
|
||||
|
||||
$this->redirectIntended(
|
||||
default: route('dashboard',
|
||||
['country' => str(session('lang_country', config('app.domain_country')))->after('-')->lower()],
|
||||
absolute: false),
|
||||
navigate: true,
|
||||
);
|
||||
|
||||
return;
|
||||
|
||||
Reference in New Issue
Block a user