Laravel应用手动邮箱验证失效：点击链接无响应待排查

问题背景 #

我在Laravel应用中手动实现邮箱验证功能，通过临时签名路由生成验证URL发送给用户，用户点击链接后进入控制器方法，对比URL参数与数据库用户数据完成验证。但点击验证链接后页面无限加载，始终空白，无任何错误提示或异常。

控制器代码（VerificationController） #

<?php

namespace App\Http\Controllers;

use App\Http\Controllers\Controller;
use App\Models\User;
use Illuminate\Http\Request;

class VerificationController extends Controller
{ 
     public function verify(Request $request)
    {
          try {
    // Log or dump the values of route parameters
    logger()->info('ID Parameter:', ['id' => $request->id]);
    logger()->info('Hash Parameter:', ['hash' => $request->hash]);

    // Retrieve the user by ID
    $user = User::findOrFail($request->id);
    logger()->info('Retrieved User:', ['user_id' => $user->id, 'user_email' => $user->email, 'hash' => $user->email_verification_token]);


    // Check if the user has an email verification token
    if ($user->email_verification_token) {
        // Compare the verification token hash from the URL with the stored token
        if ($request->route('id') == $user->getKey() &&
            hash_equals((string) $request->route('hash'), $user->email_verification_token)) {
            // If the verification token matches, mark the email as verified
            $user->email_verified_at = now();
            $user->save();

            // Redirect the user to a success page or display a success message
            return view('verification.verify-success');
        }
    }
} catch (\Exception $e) {
    // Log the error for debugging
    logger()->error('Verification Error: ' . $e->getMessage());

    // You can handle the error in different ways, such as displaying a generic error message to the user
    return view('verification.verify-error');
}

}
}

当前现象 #

点击验证链接后页面无限加载，无任何动作、错误提示或异常，页面始终空白。

已尝试的排查步骤 #

• 确认验证链接包含正确的用户ID和hash参数
• 检查数据库，确认用户的email_verification_token与URL中的hash参数匹配
• 检查控制器中的验证逻辑，确认参数对比和标记邮箱已验证的逻辑正确

日志信息 #

ID Parameter: {"id":"7"}
Hash Parameter: {"hash":"kR8yO2UdkyehKg1RZHxopxXJAaHYl2GD3u2Yx87fIa3GWrMnYL2TO1JdNGZL"}
Retrieved User: {"user_id":7,"user_email":"cheiayisd@gmail.com","hash":"kR8yO2UdkyehKg1RZHxopxXJAaHYl2GD3u2Yx87fIa3GWrMnYL2TO1JdNGZL"}

验证URL示例：
path/email/verify/7?expires=1707613077&hash=kR8yO2UdkyehKg1RZHxopxXJAaHYl2GD3u2Yx87fIa3GWrMnYL2TO1JdNGZL&signature=bdf584c3619d231aa979e6db8e5abab9bf55a74ab47949f37b41d5c1ebc3c87a

User模型代码 #

<?php

namespace App\Models;

use Illuminate\Contracts\Auth\MustVerifyEmail;
use Illuminate\Foundation\Auth\User as Authenticatable;
use Illuminate\Notifications\Notifiable;
use Illuminate\Database\Eloquent\Factories\HasFactory;

class User extends Authenticatable implements MustVerifyEmail
{
    use HasFactory, Notifiable;

    /**
     * The attributes that are mass assignable.
     *
     * @var array
     */
    protected $fillable = [
        'name',
        'email',
        'password',
        'confirmpassword',
        'role', 
        'email_verification_token'
    ];

    /**
     * The attributes that should be hidden for arrays.
     *
     * @var array
     */
    protected $hidden = [
        'password',
        'confirmpassword',
        'remember_token',
    ];

    /**
     * The attributes that should be guarded from mass assignment.
     *
     * @var array
     */
    protected $guarded = [
        // Remove 'role' from the $guarded array
    ];

    /**
     * The attributes that should be cast to native types.
     *
     * @var array
     */
    protected $casts = [
        'email_verified_at' => 'datetime',
    ];

    /**
     * Send the email verification notification.
     */
    public function sendEmailVerificationNotification()
    {
        $this->notify(new \App\Notifications\VerifyEmail);
    }
    
}

问题原因分析 #

从URL结构可以看到，hash是查询参数（URL中的?hash=xxx部分），但控制器代码中使用$request->route('hash')获取该值——这个方法只能获取路由路径中的参数（比如/email/verify/{id}里的id），无法拿到查询参数，导致hash_equals对比失败。而代码在条件不满足时没有任何返回逻辑，也没有触发catch块，最终控制器没有输出任何响应，造成页面空白无限加载。

解决方案 #

1. 修正hash参数获取方式 #

将对比逻辑中的$request->route('hash')改为$request->hash或$request->query('hash')，正确获取查询参数中的hash值。

2. 补充异常分支的返回逻辑 #

在条件不满足时（比如token不匹配、无验证token），返回错误页面，避免控制器无响应。

3. 可选：验证后清除验证token #

验证成功后清除email_verification_token，防止重复验证。

修正后的控制器代码 #

<?php

namespace App\Http\Controllers;

use App\Http\Controllers\Controller;
use App\Models\User;
use Illuminate\Http\Request;

class VerificationController extends Controller
{ 
     public function verify(Request $request)
    {
          try {
            logger()->info('ID Parameter:', ['id' => $request->id]);
            logger()->info('Hash Parameter:', ['hash' => $request->hash]);

            $user = User::findOrFail($request->id);
            logger()->info('Retrieved User:', ['user_id' => $user->id, 'user_email' => $user->email, 'hash' => $user->email_verification_token]);

            if ($user->email_verification_token) {
                // 修正hash参数获取方式，使用查询参数
                if ($request->route('id') == $user->getKey() &&
                    hash_equals((string) $request->hash, $user->email_verification_token)) {
                    $user->email_verified_at = now();
                    $user->email_verification_token = null; // 清除验证token
                    $user->save();

                    return view('verification.verify-success');
                }
            }

            // 条件不满足时返回错误页面
            return view('verification.verify-error');
        } catch (\Exception $e) {
            logger()->error('Verification Error: ' . $e->getMessage());
            return view('verification.verify-error');
        }
    }
}

内容的提问来源于stack exchange，提问作者Vee