One of my website is developed in Laravel, it was working fine before. What does is I want to move website from beta.example.com to example.com so I have pointed to beta with original domain name(example.com).
The Website is working fine but all remember me functionality is not working. Now Users have to enter the password and also if they check the check box (remember me) still it does not store the password in cookies or session.
Please help me.
Thank you
You have two options:
1) Add remember_token column in your users table - this is where the token will be stored.
2) Pass true as a second parameter of Auth::attempt() to enable remember me behaviour.
If you do this, Laravel will generate a token that will be saved in users table and in a cookie.
On subsequent requests, even if session cookie is not available, user will be authenticated automatically as long as remember-me cookie is there.
Related
I manage to update a secret_key column after the laravel login using Auth. However, what I want is to not set the Auth::user yet because I want to verify the user first by adding a verification that I send via email. The problem is that after I login the Auth::user already have a value and the other URLs are already accessible. Can anyone help me?
Cheers!
So i have created a project and right now i have to give information about every cookie that it is used. I am using laravel 5.0 and the cookies that are used by laravel are the below :
1) laravel_session
2) XSRF-TOKEN
I know about the second one, but i can't find information about the first one. Is it about knowing the current user? The project also uses socialite - facebook.
Please, if you need any further information feel free to ask and i will provide.
Internally laravel uses laravel_session to identify a session instance for a user, this can be changed by going into config/session.php and editing the cookie value
i'm trying to create a web app with back and front end separated, so there is two project here. The reason is there is a plan in the future to create mobile version as well, so i made it decoupled.
Just FYI the back are created with PHP using laravel4 and barryvdh CORS
and the front end are created purely with angularjs and bootstrap.
The current situation is that i create a rest API in my back end app to do login, auth, and logout.and in the front end i have 2 pages, which is login and index page.
Login page are composed of username, password input field and submit button,
when user click submit button, it will call the login rest API from the back end and i expect it would persist cookie to the front end page if login success, but it doesn't (because of cross origin policy, i've research as much).
The question is, is there any way to set sessions across domains now it is 2014, where any article i found are from 2012 older. If it's not possible, what's the easiest way to persist session across domain besides OAUTH2 and openID (because their learning curve are just too steep, the application i'm creating are just small app)
Thanks for your assistance.
what I have done so far to work with cross-domain sessions is to create a "passport" service on a another domain and validate & handle the session from the there.
For example...
domain1.com has webserver1
domain2.com has webserver2
passport.com has webserver3
Whenever I connect either to domain1.com or domain2.com I'm including a line at the very top of the script index checking on passport.com/check.php whether there's a browser session already initialized under the name of "PASSPORT", if so, I finish the checking on passport.com and let the script on domain1.com or domain2.com to do their stuff.
In case the browser session wasn't initialized, the check.php will redirect the index via header() to the login.php page. This will validate against LDAP and if binding the user is OK then the browser session is initialized with the name of "PASSPORT" and including all the fields I need furthermore to validate the user and its accesses. Ref back to the index once is done.
When the user goes from domain1.com to domain2.com (or the other way around) the script included at the top of each index will check the session again all the time, taking the user to the login script or letting him access the required site.
As additional checking you can create the session and add variables such as "valid until", "access level", etc.
Hope this helps and if you need further clarification let me know.
Best,
Emiliano.
My Users can change their passwords on a form. If this the form is valid I encode it, invalidate the session by using
$this->get('security.context')->setToken(null);
$this->getSession()->invalidate();
...flush the user to the database and do a redirect (to the same url).
Beside this I have a mechanism to store some information in the session before forwarding and showing this data in the 'forwarded' template.
Both work well on their own, but not together :-)
I can see, that the value is written (after invalidating the session) and I believe, that symfony instantiates a new session.
I just don't know, what happens after that. Maybe symfony is doing 'some magic', because it 'injects' the login-page before show the redirected url.
I don't really understand what you're trying to do, and why you're invalidating the session, but your User need to be logged in to see the redirected URL.
Your code logs him out.
You can log a user by doing so :
use Symfony\Component\Security\Core\Authentication\Token\UsernamePasswordToken;
$authToken = new UsernamePasswordToken($user, null, 'secured_area', array('ROLE_USER'));
$this->get('security.context')->setToken($authToken);
The third parameter is the providerKey, and the fourth is a roles array.
I am using Asp.net MVC 3 in my project. I have a simple login page which takes username and password and after successful login, take me to the required page.
The problem is when I press back button from my browser and then press forward button again and again, it takes me again to the page without getting username and password from the user.
I don't know, may be it is the problem with sessions state. Because I didn't make any sessions and I don't how to make it.
Please anyone out there help me a bit to mitigate this problem.
Your session id is stored in a cookie, on successful authentication, the cookie gets stored on your machine, when you move forward in history, it doesn't get removed.
If you explicitly clear the cookie on each visit to the login page using:
Session.Abandon()
this will kill the authenticated session and create a new anonymous one, which shouldn't have access to the restricted page