Skip to content

Conversation

@valorin
Copy link
Contributor

@valorin valorin commented Sep 29, 2025

Use Session::regenerate() instead of Session::migrate() during the login flow.

@taylorotwell
Copy link
Member

@valorin does this have any risk of breaking changes with the other changes we've made in terms of regenerating and migrating twice, etc.

@valorin
Copy link
Contributor Author

valorin commented Sep 30, 2025

@taylorotwell Nope, there should be no negative effects or breaking changes associated with this and the other changes we made. 👍

The login flow already called migrate() and regenerate() together, with the only difference between migrate() and regenerate() being generating a random string and storing it in the session:

public function regenerateToken()
{
$this->put('_token', Str::random(40));
}

@taylorotwell taylorotwell merged commit 975d60a into laravel:12.x Oct 8, 2025
63 checks passed
@AhmedAlaa4611
Copy link
Contributor

Should we also invalidate() and regenerateToken() in logout()?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

3 participants