**Nostr Login:** Improved CSRF token handling during login flow.

- 🛡️ Avoided redundant `Session::regenerate` call as `Auth::loginUsingId` already updates the session ID.
- 🚀 Replaced `wire:navigate` with a full-page redirect to ensure a fresh CSRF token for Livewire actions.
This commit is contained in:
BT
2026-05-04 00:15:37 +02:00
parent 2efc88a7f8
commit dc723855df
@@ -137,13 +137,19 @@ class extends Component {
]);
}
FetchNostrProfileJob::dispatch($user);
// Auth::loginUsingId() already regenerates the session id (see
// SessionGuard::updateSession), so an explicit Session::regenerate()
// would just rotate the CSRF token a second time. We also avoid
// wire:navigate here: it preserves the <meta name="csrf-token"> tag
// from the previous page, so any subsequent Livewire action on the
// destination would 419 (TokenMismatch). A full-page redirect gives
// the browser a fresh document with a fresh token.
Auth::loginUsingId($user->id);
Session::regenerate();
$this->redirectIntended(
default: route('dashboard',
['country' => str(session('lang_country', config('app.domain_country')))->after('-')->lower()],
absolute: false),
navigate: true,
);
return;