mirror of
https://github.com/HolgerHatGarKeineNode/einundzwanzig-app.git
synced 2026-05-05 04:54:53 +00:00
✨ **Nostr Login:** Improved CSRF token handling during login flow.
- 🛡️ Avoided redundant `Session::regenerate` call as `Auth::loginUsingId` already updates the session ID. - 🚀 Replaced `wire:navigate` with a full-page redirect to ensure a fresh CSRF token for Livewire actions.
This commit is contained in:
@@ -137,13 +137,19 @@ class extends Component {
|
|||||||
]);
|
]);
|
||||||
}
|
}
|
||||||
FetchNostrProfileJob::dispatch($user);
|
FetchNostrProfileJob::dispatch($user);
|
||||||
|
// Auth::loginUsingId() already regenerates the session id (see
|
||||||
|
// SessionGuard::updateSession), so an explicit Session::regenerate()
|
||||||
|
// would just rotate the CSRF token a second time. We also avoid
|
||||||
|
// wire:navigate here: it preserves the <meta name="csrf-token"> tag
|
||||||
|
// from the previous page, so any subsequent Livewire action on the
|
||||||
|
// destination would 419 (TokenMismatch). A full-page redirect gives
|
||||||
|
// the browser a fresh document with a fresh token.
|
||||||
Auth::loginUsingId($user->id);
|
Auth::loginUsingId($user->id);
|
||||||
Session::regenerate();
|
|
||||||
$this->redirectIntended(
|
$this->redirectIntended(
|
||||||
default: route('dashboard',
|
default: route('dashboard',
|
||||||
['country' => str(session('lang_country', config('app.domain_country')))->after('-')->lower()],
|
['country' => str(session('lang_country', config('app.domain_country')))->after('-')->lower()],
|
||||||
absolute: false),
|
absolute: false),
|
||||||
navigate: true,
|
|
||||||
);
|
);
|
||||||
|
|
||||||
return;
|
return;
|
||||||
|
|||||||
Reference in New Issue
Block a user