Laravel 11登录后重定向Session丢失，登录状态无法保持求助

问题描述 #

开发基础登录功能时，使用Auth::attempt()完成验证，成功后重定向到仪表盘，但登录状态无法保留。未添加过Auth::logout()代码，仅修改了auth.php配置，疑似Session无法保留数据。

相关代码 #

1. config/auth.php #

'guards' => [
    'web' => [
        'driver' => 'session',
        'provider' => 'administrators',
    ],
    'api' => [
        'driver' => 'passport',
        'provider' => 'users',
    ]
],

'providers' => [
    'users' => [
        'driver' => 'eloquent',
        'model' => env('AUTH_MODEL', User::class),
    ],
    'administrators' => [
        'driver' => 'eloquent',
        'model' => env('AUTH_ADMIN_MODEL', Administrator::class),
    ],
],

2. routes/web.php #

<?php

use App\Http\Controllers\Admin\AuthenticationController;
use Illuminate\Support\Facades\Route;

Route::domain(env('ADMIN_DOMAIN'))->group(function () {
    Route::prefix('auth')->name('auth.')->group(function () {
        Route::get('/login', [AuthenticationController::class, 'index'])->name('login');
        Route::post('/login', [AuthenticationController::class, 'authenticate'])->name('authenticate');
    })->middleware('guest');

    Route::middleware('auth')->group(function () {
        Route::name('dashboard.')->group(function () {
            Route::get('/', function () {
                return 1;
            })->name('index');
        });
    });
});

3. AuthenticationController.php #

public function authenticate(LoginRequest $request): RedirectResponse
{
    $credential = [
        'account_id' => $request->validated('account_id'),
        'password' => $request->validated('password'),
    ];
    if(!Auth::attempt($credential, $request->validated('remember'))) {
        return $this->response(
            route('dashboard.index'),
            __('content.auth.login.failed'),
            HttpResponseCode::UNAUTHORIZED
        );
    }

    $request->session()->regenerate();

    return $this->redirectIntended(route('dashboard.index'), __('content.auth.login.success'));
}

4. .env #

APP_KEY=base64:NQ+cqFjdJ3xlo/H6bFhE72kDxVQbdthntNi1iaoFZ/k=
APP_NAME="Laravel"
APP_ENV=local
APP_DEBUG=true
APP_TIMEZONE="Asia/Ho_Chi_Minh"
APP_URL=http://localhost:8000

APP_LOCALE=vi
APP_FALLBACK_LOCALE=vi
APP_FAKER_LOCALE=en_US

APP_MAINTENANCE_DRIVER=file
APP_MAINTENANCE_STORE=database

BCRYPT_ROUNDS=12

LOG_CHANNEL=daily
LOG_STACK=single
LOG_DEPRECATIONS_CHANNEL=null
LOG_LEVEL=debug

DB_CONNECTION=mysql
DB_HOST=localhost
DB_PORT=3306
DB_DATABASE=db
DB_USERNAME=root
DB_PASSWORD=root

SESSION_DRIVER=database
SESSION_LIFETIME=120
SESSION_ENCRYPT=false
SESSION_PATH=/
SESSION_DOMAIN=null

BROADCAST_CONNECTION=log
FILESYSTEM_DISK=local
QUEUE_CONNECTION=database

CACHE_STORE=database
CACHE_PREFIX=

MEMCACHED_HOST=127.0.0.1

REDIS_CLIENT=phpredis
REDIS_HOST=127.0.0.1
REDIS_PASSWORD=null
REDIS_PORT=6379

MAIL_MAILER=smtp
MAIL_HOST=smtp-relay.brevo.com
MAIL_PORT=587
MAIL_USERNAME=
MAIL_PASSWORD=
MAIL_ENCRYPTION=tls
MAIL_FROM_ADDRESS=""
MAIL_FROM_NAME="${APP_NAME}"

AWS_ACCESS_KEY_ID=
AWS_SECRET_ACCESS_KEY=
AWS_DEFAULT_REGION=us-east-1
AWS_BUCKET=
AWS_USE_PATH_STYLE_ENDPOINT=false

VITE_APP_NAME="${APP_NAME}"

ADMIN_DOMAIN=""
API_DOMAIN=""

排查与解决思路 #

1. 指定认证守卫
   你修改了默认web守卫的provider为administrators，建议显式指定守卫避免上下文歧义：

   • 控制器中修改认证逻辑：

     if(!Auth::guard('web')->attempt($credential, $request->validated('remember'))) {
         // 原有失败逻辑
     }
     

   • 路由中修改auth中间件：

     Route::middleware('auth:web')->group(function () {
         // 仪表盘路由
     });
     

2. Session配置检查

   • 确认已执行php artisan session:table和php artisan migrate，生成session数据表（因为你用了SESSION_DRIVER=database）。
   • 本地环境SESSION_DOMAIN=null没问题，若后续使用子域名，需设置为.localhost这类通配格式。
   • 确保APP_KEY有效，Laravel依赖它加密Session数据，若密钥无效会导致Session无法正常存储。

3. 用户模型认证字段
   你用account_id作为认证字段，需在Administrator模型中重写username()方法：

   class Administrator extends Model implements Authenticatable
   {
       use Authenticatable;
   
       public function username()
       {
           return 'account_id';
       }
   }
   

   否则Auth::attempt()会默认用email字段匹配，导致验证成功但无法正确加载用户。

4. 中间件顺序验证
   检查app/Http/Kernel.php的web中间件组，确保StartSession和AuthenticateSession中间件存在且顺序正确：

   protected $middlewareGroups = [
       'web' => [
           // ...
           \Illuminate\Session\Middleware\StartSession::class,
           \Illuminate\Session\Middleware\AuthenticateSession::class,
           // ...
       ],
   ];
   

内容的提问来源于stack exchange，提问作者ChanhHuynh