Laravel 10 Sanctum邮箱验证后email_verified_at字段未更新求助

核心问题分析 #

点击验证链接后跳登录页但字段未更新，本质是默认邮箱验证逻辑依赖Web Session认证，而API用户使用Token认证，无Web会话，导致验证路由的auth中间件拦截请求，跳转到登录页，验证逻辑根本没执行。

具体解决步骤 #

1. 修改验证控制器逻辑 #

找到app/Http/Controllers/Auth/VerifyEmailController.php，调整中间件和验证逻辑：

<?php

namespace App\Http\Controllers\Auth;

use App\Http\Controllers\Controller;
use Illuminate\Auth\Events\Verified;
use Illuminate\Foundation\Auth\EmailVerificationRequest;
use Illuminate\Http\RedirectResponse;

class VerifyEmailController extends Controller
{
    /**
     * Create a new controller instance.
     *
     * @return void
     */
    public function __construct()
    {
        // 移除强制auth中间件，仅保留签名验证（邮箱链接自带签名，已保证合法性）
        $this->middleware('signed')->only('verify');
        // 可选：保留频率限制中间件
        $this->middleware('throttle:6,1')->only('verify', 'resend');
    }

    /**
     * Mark the authenticated user's email address as verified.
     *
     * @param  EmailVerificationRequest  $request
     * @return RedirectResponse
     */
    public function verify(EmailVerificationRequest $request): RedirectResponse
    {
        // 直接通过请求中的用户实例执行验证，无需依赖Web会话
        if ($request->user()->hasVerifiedEmail()) {
            return redirect()->intended(config('app.frontend_url').'/dashboard?verified=1');
        }

        if ($request->user()->markEmailAsVerified()) {
            event(new Verified($request->user()));
        }

        return redirect()->intended(config('app.frontend_url').'/dashboard?verified=1');
    }
}

关键改动：移除auth中间件，确保只要链接签名合法，就能执行验证逻辑，不受Web会话限制。

2. 修正Web路由配置 #

确保routes/web.php中的邮箱验证路由与控制器配置一致：

use App\Http\Controllers\Auth\VerifyEmailController;

Route::get('/email/verify/{id}/{hash}', [VerifyEmailController::class, 'verify'])
    ->middleware(['signed'])
    ->name('verification.verify');

注意：移除路由上原有的auth中间件，避免拦截无Web会话的API用户请求。

3. 确认User模型实现 #

再次检查app/Models/User.php是否正确实现MustVerifyEmail接口：

use Illuminate\Contracts\Auth\MustVerifyEmail;
use Illuminate\Foundation\Auth\User as Authenticatable;

class User extends Authenticatable implements MustVerifyEmail
{
    // ... 其他模型代码
}

4. 确保注册时触发验证邮件 #

在注册控制器的store方法中，确认创建用户后调用了发送验证邮件的方法：

public function store(Request $request)
{
    $validated = $request->validate([
        'name' => 'required|string|max:255',
        'email' => 'required|string|email|max:255|unique:users',
        'password' => 'required|string|confirmed|min:8',
    ]);

    $user = User::create([
        'name' => $validated['name'],
        'email' => $validated['email'],
        'password' => Hash::make($validated['password']),
    ]);

    // 发送邮箱验证通知
    $user->sendEmailVerificationNotification();

    return response()->json([
        'user' => new UserResource($user),
        'message' => '请检查邮箱完成验证'
    ], 201);
}

测试验证 #

1. 重新注册用户，获取验证邮件
2. 点击验证链接，此时不会跳转登录页，直接执行验证逻辑
3. 查看数据库users表的email_verified_at字段，应已更新为当前时间

内容的提问来源于stack exchange，提问作者TinoOo