Laravel自定义登录报错：凭据不匹配问题求助

我正在学习Laravel框架，此前已搭建过小型应用，目前尝试自建一个小型CMS。创建了AuthController、路由及login.blade.php登录表单，但登录时始终提示**"The provided credentials do not match our records!"**错误。手动在数据库中添加了经bcrypt('password')加密的用户数据，仍无法登录。

相关代码 #

web.php #

<?php

use Illuminate\Support\Facades\Route;
use App\Http\Controllers\AuthController;

Route::get('/', function () {
    return view('welcome');
});

// Login
Route::get('/login', [AuthController::class, 'showLoginForm'])->name('login.form');
Route::post('/login', [AuthController::class, 'login'])->name('login.submit');

// Logout
Route::get('/logout', [AuthController::class, 'logout'])->name('logout');

AuthController.php #

<?php

namespace App\Http\Controllers;

use Illuminate\Http\Request;
use Illuminate\Support\Facades\Auth;
use Illuminate\Http\RedirectResponse;

class AuthController extends Controller
{
    public function showLoginForm()
    {
        return view('auth.login');
    }

    public function login(Request $request): RedirectResponse
    {
        $credentials = $request->validate([
            'email' => ['required', 'email'],
            'password' => ['required'],
        ]);

        $remember = $request->has('remember');

        if(Auth::attempt($credentials, $remember)) {
            $request->session()->regenerate();

            return redirect()->intended('/'); // Redirects to home page after log in
        }

        return back()->withErrors([
            'email' => 'The provided credentials do not match our records!'
        ])->onlyInput('email');
    }

    public function logout(Request $request): RedirectResponse
    {
        Auth::logout();

        $request->session()->invalidate();
        $request->session()->regenerateToken();

        return redirect('/');
    }
}

login.blade.php #

@extends('layouts.auth')

@section('content')
    <div class="">
        <a class="">
            PI Blog
        </a>
        @if ($errors->any())
            <div class="">
                <ul>
                    @foreach ($errors->all() as $error)
                        <li>{{ $error }}</li>
                    @endforeach
                </ul>
            </div>
        @endif
        <div class="">
            <div class="p-6 space-y-4 md:space-y-6 sm:p-8">
                <h1 class="">
                    Sign in to your account
                </h1>
                <form class="" action="{{ route('login.submit') }}" method="post">
                    @csrf
                    <div>
                        <label for="email" class="">Your email</label>
                        <input type="email" name="email" id="email" class="" placeholder="name@domain.com" required>
                    </div>
                    <div>
                        <label for="password" class="">Password</label>
                        <input type="password" name="password" id="password" placeholder="••••••••" class="" required="">
                    </div>
                    <div class="">
                        <div class="">
                            <div class="">
                              <input id="remember" aria-describedby="remember" type="checkbox" class="">
                            </div>
                            <div class="ml-3 text-sm">
                              <label for="remember" class="">Remember me</label>
                            </div>
                        </div>
                        <a href="#" class="">Forgot password?</a>
                    </div>
                    <button type="submit" class="">Sign in</button>
                    <p class="">
                        Don’t have an account yet? <a href="#" class="">Sign up</a>
                    </p>
                </form>
            </div>
        </div>
    </div>
@endsection

2023_10_22_192933_create_users_table.php #

<?php

use Illuminate\Database\Migrations\Migration;
use Illuminate\Database\Schema\Blueprint;
use Illuminate\Support\Facades\Schema;

return new class extends Migration
{
    public function up(): void
    {
        Schema::create('users', function (Blueprint $table) {
            $table->id();
            $table->foreignId('role_id')->constrained()->onDelete('cascade');
            $table->string('username')->unique();
            $table->string('email')->unique();
            $table->timestamp('email_verified_at')->nullable();
            $table->string('password');
            $table->rememberToken();
            $table->timestamps();
        });
    }

    public function down(): void
    {
        Schema::dropIfExists('users');
    }
};

数据库用户数据 #

id: 1
role_id: 1
username: user
email: user@gmail.com
email_verified_at: 2023-10-24 21:07:05
password: $2y$10$RKa.O9wZSchX9XUgGr0O6OlDI49Tsv2T7JQDTN96/de7sKLsB0AbG
remember_token: NULL
created_at: 2023-10-24 21:05:05
updated_at: 2023-10-24 21:05:05

注：已移除Blade文件中的所有Tailwind类以提升可读性，所有类均为Tailwind类。登录时输入了对应邮箱和用于bcrypt加密的密码（尝试过带引号和不带引号），也重新构建了项目，但问题仍未解决。

排查方向与解决方法 #

1. 检查User模型的认证配置 #

打开app/Models/User.php，确保模型正确继承Laravel的认证基类，且没有错误修改认证字段：

namespace App\Models;

use Illuminate\Foundation\Auth\User as Authenticatable;
use Illuminate\Notifications\Notifiable;

class User extends Authenticatable
{
    use Notifiable;

    // 确保批量赋值字段包含必要的认证相关字段
    protected $fillable = [
        'username',
        'email',
        'password',
        'role_id',
    ];
}

如果模型重写了username()方法，需确保返回的是email（或你实际用于认证的字段），否则会导致认证匹配失败。

2. 验证密码哈希有效性 #

在终端执行tinker工具，检查数据库中的哈希值是否匹配明文密码password：

php artisan tinker

输入以下命令验证：

echo Hash::check('password', '$2y$10$RKa.O9wZSchX9XUgGr0O6OlDI49Tsv2T7JQDTN96/de7sKLsB0AbG');

若返回false，说明哈希值生成错误，重新生成正确的哈希值替换数据库中的密码：

echo Hash::make('password');

3. 确认凭证传递正确性 #

在AuthController的login方法中临时添加日志，查看表单提交的凭证是否正确：

public function login(Request $request): RedirectResponse
{
    $credentials = $request->validate([
        'email' => ['required', 'email'],
        'password' => ['required'],
    ]);

    // 临时日志输出，查看获取到的凭证
    \Log::info('Login credentials:', $credentials);

    $remember = $request->has('remember');

    if(Auth::attempt($credentials, $remember)) {
        $request->session()->regenerate();
        return redirect()->intended('/');
    }

    return back()->withErrors([
        'email' => 'The provided credentials do not match our records!'
    ])->onlyInput('email');
}

查看storage/logs/laravel.log，确认email和password与输入内容一致。

4. 检查用户状态 #

如果users表包含软删除字段deleted_at或自定义状态字段（如is_active），需确保用户未被软删除且状态为激活：

• 若使用软删除，模型需添加SoftDeletes trait，Laravel默认会排除已软删除的用户；
• 若有自定义状态字段，需在模型中添加认证逻辑过滤，或修改Auth::attempt的查询条件。

5. 清除缓存 #

执行以下命令清除缓存，避免配置或路由缓存导致的异常：

php artisan cache:clear
php artisan config:clear
php artisan route:clear

内容的提问来源于stack exchange，提问作者Povilaitis Ignas