Laravel中web.php与AuthController的Auth::user()获取用户不一致问题

登录后AuthController中能正确获取当前用户，但跳转到web.php的auth中间件组路由时，Auth::user()返回错误用户。具体表现：

• AuthController的login方法日志打印正确用户：handphone（角色donor）
• web.php首页路由（auth中间件内）日志打印错误用户：sandwich（角色admin）

相关代码 #

web.php #

<?php

use Illuminate\Support\Facades\Route;
use App\Http\Controllers\AuthController;
use App\Http\Controllers\PantiController;
use App\Http\Controllers\ProductController;
use App\Http\Middleware\CheckRole;
use Illuminate\Support\Facades\Auth;
use Illuminate\Support\Facades\Log;

Route::get('/register', [AuthController::class, 'showRegisterForm'])->name('register');
Route::get('/login', [AuthController::class, 'showLoginForm'])->name('login');

Route::post('/register', [AuthController::class, 'register']);
Route::post('/login', [AuthController::class, 'login']);

Route::get('/product/{id}', [ProductController::class, 'show'])->name('product.detail');
Route::get('/panti/{id}', [PantiController::class, 'show'])->name('panti.detail');

Route::middleware('auth')->group(function () {
    Route::get('/', function (){
        $user = Auth::user();

        Log::info('Currently User logged in:', ['user' => $user]);

        if($user->role == 'donor'){
            return view('page.home.home-donor', ['user' => $user]);
        }else if($user->role== 'panti'){
            return view('page.home.home-panti', ['user' => $user]);
        }else if($user->role == 'admin'){
            return view('page.home.home-admin', ['user' => $user]);
        }
    })->name('home');

    Route::get('/catalog', function () {
        return view('page.catalog');
    })->name('catalog');
    
    Route::get('/panti', function () {
        return view('page.panti');
    })->name('panti');
    
    Route::get('/about', function () {
        return view('page.about');
    })->name('about');

    Route::get('/product/{id}', [ProductController::class, 'show'])->name('product.detail');
    
    Route::get('/panti/{id}', [PantiController::class, 'show'])->name('panti.detail');

    Route::get('/profile', function () {
        $user = Auth::user(); // Get the authenticated user
        return view('page.profile', ['user' => $user]);
    })->name('profile');

    Route::post('/logout', [AuthController::class, 'logout']);
});

AuthController.php #

<?php

namespace App\Http\Controllers;

use App\Models\User;
use Illuminate\Http\Request;
use Illuminate\Support\Facades\Auth;
use Illuminate\Support\Facades\Hash;
use Illuminate\Support\Facades\Log;
use Illuminate\Support\Facades\Validator;

class AuthController extends Controller
{
    // Show the registration form
    public function showRegisterForm()
    {
        return view('auth.register');
    }

    // Show the login form
    public function showLoginForm()
    {
        return view('auth.login');
    }

    // Register user
    public function register(Request $request)
    {
        $validator = Validator::make($request->all(), [
            'username' => 'required|string|max:100|unique:users',
            'name' => 'required|string|max:100',
            'email' => 'required|string|email|max:100|unique:users',
            'password' => 'required|string|min:8|confirmed',
            'role' => 'required|in:donor,panti,admin',
        ]);

        if ($validator->fails()) {
            return redirect()->back()->withErrors($validator)->withInput();
        }

        User::create([
            'username' => $request->username,
            'name' => $request->name,
            'email' => $request->email,
            'password' => Hash::make($request->password),
            'role' => $request->role,
        ]);

        return redirect('/login')->with('success', 'Registration successful! Please login.');
    }

    // Login user
    public function login(Request $request)
    {
        $credentials = $request->only('username', 'password');

        $user = User::where('username', $credentials['username'])->first();

        if (!$user || !Hash::check($credentials['password'], $user->password)) {
            return redirect()->back()->withErrors(['login_error' => 'Invalid username or password.']);
        }
        
        Auth::login($user, true);
        $request->session()->regenerateToken();

        Log::info('User logged in:', ['user' => $user]);
        
        if (Auth::check()) {
            return redirect('/')->with('success', 'Login successful!');
        } else {
            return redirect('/login')->withErrors(['login_error' => 'Authentication failed.']);
        }        
    }

    // Logout
    public function logout(Request $request)
    {
        Auth::logout();
        $request->session()->invalidate();  // Invalidates the session
        $request->session()->regenerateToken();  // Regenerates the CSRF token to prevent CSRF attacks
        return redirect('/login')->with('success', 'Logged out successfully!');
    }
}

日志信息 #

[2024-12-22 03:32:27] local.INFO: User logged in: {"user":{"App\Models\User":{"user_id":0,"username":"handphone","name":"handphone","email":"handphone@gmail.com","role":"donor","user_image":null,"remember_token":"fcvFDZa6WaOlVZTeVbEkLZN078B9RWR1jULhQZGzyHWCEsoZKRnQ7SLMzvYs","created_at":"2024-12-14T13:20:00.000000Z","updated_at":"2024-12-14T20:51:41.000000Z"}}} 
[2024-12-22 03:32:27] local.INFO: Currently User logged in: {"user":{"App\Models\User":{"user_id":0,"username":"sandwich","name":"sandwich","email":"sandwich@gmail.com","role":"admin","user_image":null,"remember_token":"pZCLwvv2aMwnRwJPzULk403cTwWuYUcYPjvNi4EL8p7yVzMle7nC2gYP3Pho","created_at":"2024-12-15T13:48:17.000000Z","updated_at":"2024-12-15T20:48:23.000000Z"}}}

排查与解决方案 #

1. 修正用户模型主键配置 #

日志显示两个用户的user_id均为0，说明User模型未正确设置主键。Laravel默认主键为id，若数据表使用user_id作为主键，需在app/Models/User.php中显式定义：

protected $primaryKey = 'user_id';
public $incrementing = true; // 若user_id为自增类型，需开启此配置

主键配置错误会导致Auth系统无法正确识别用户身份，引发会话匹配异常。

2. 登录时完整重新生成会话 #

当前登录方法仅调用regenerateToken()，未重新生成会话ID，可能导致旧会话残留。修改AuthController的login方法：

// 替换原regenerateToken()调用
$request->session()->regenerate();

regenerate()会完全重新生成会话ID及CSRF令牌，彻底隔离旧会话数据。

3. 清理缓存与会话 #

• 执行Laravel缓存清理命令：php artisan cache:clear
• 清理会话存储：php artisan session:clear
• 手动清除浏览器缓存及Cookie，避免旧会话Cookie干扰。

4. 移除重复路由定义 #

web.php中/product/{id}和/panti/{id}在auth组内外各定义一次，虽不直接影响认证，但可能引发路由匹配异常，建议保留一组定义（根据业务需求选择是否需要auth校验）。

内容的提问来源于stack exchange，提问作者Christian Antonius Anggaresta