How does Laravel fetch a user based on a given session?

problem description

now a scenario is that GET requests a url, without cookie, so the session is passed through query, for example:

https://www.example.com/getxx.

so, after getting the sessionid in the controller, how do I get the logged-in user?

in other words, how Laravel authenticates against sessionid.

$request->session()->setId("zvxBAKjfgABQa0Gf1BepMsjtwONilFEWbhHGA6EG");

you have tried to set the current sessionid, first and then use Auth::user () to get it, which is not available. Is there any way for everyone?

Mar.08,2022

restart session
clipboard.png


< H2 > Database storage Session < / H2 >

because you can see from the migration file that the sessions table contains the user_id field, you can query and retrieve the user by yourself.

< H2 > File Storage Session < / H2 >

needs to deserialize to get the corresponding Session information and extract User id from it

< H2 > Redis and Memcached < / H2 >

is not tested, but should belong to one of the above two.

< H2 > say a few more sentences < / H2 >

this situation is very insecure, and exposure of Session or Cookie means that the user's login credentials are exposed. It is recommended to use JWT or OAuth for user authentication.

Menu