Laravel登录时提示页面因闲置过期，角色验证中间件失效求助

Hey there, let's dig into your problem and get that annoying "page expired due to inactivity" prompt and your broken role validation middleware sorted out!

This error almost always ties to session management issues—either your session isn't being properly initialized after login, or it's getting destroyed immediately. Here's what to check:

• Verify session configuration: Pop open config/session.php and double-check these settings:
  • lifetime: If this is set to an extremely low value (like 1 minute), your session could expire right after login. Set it to a reasonable number (e.g., 120 for 2 hours).
  • driver: Make sure it's not set to array—that's an in-memory driver that gets wiped after every request. Use file or database instead for persistent sessions.
  • expire_on_close: If this is true, closing the browser will kill the session, but it shouldn't trigger an immediate expired message after login.
• Check your login logic: In your AuthController@postSign... method, ensure you're actually initializing the user session after successful authentication. Use Laravel's built-in auth helpers like:

  if (Auth::attempt($credentials)) {
      // This properly logs the user in and initializes their session
      return redirect()->route('dashboard', ['user_id' => Auth::id()]);
  }
  

  If you're manually handling sessions, make sure you're setting a persistent session value (e.g., session(['user_id' => $user->id])) instead of just passing the ID in the URL.

Looking at your routes, the /dashboard/{user_id} route isn't attached to your role middleware at all—that's why your role checks aren't working! Here's how to fix it:

• Attach middleware to the dashboard route: Update your route definition to include your middleware (replace checkRole with your actual middleware name):

  // Option 1: Using array syntax
  Route::get('/dashboard/{user_id}', [
      'as' => 'dashboard',
      'middleware' => 'checkRole',
      function ($user_id) {
          return view('theme.index')->with(['id'=>$user_id]);
      }
  ]);
  
  // Option 2: Cleaner chained syntax
  Route::get('/dashboard/{user_id}', function ($user_id) {
      return view('theme.index')->with(['id'=>$user_id]);
  })->name('dashboard')->middleware('checkRole');
  

• Update your middleware to check for active sessions first: In your role validation middleware, always verify the user is logged in before checking their role—otherwise, you'll trigger the expired prompt even after a successful login:

  public function handle($request, Closure $next)
  {
      // First, make sure the user is authenticated
      if (!Auth::check()) {
          return redirect('/')->with('error', '页面因闲置已过期，请刷新后重试');
      }
  
      // Now run your role validation logic
      $user = Auth::user();
      if (!$user->hasPermissionToAccessDashboard()) { // Replace with your actual role check
          abort(403, 'You don\'t have permission to access this page');
      }
  
      return $next($request);
  }
  

Make sure your login controller redirects to the dashboard route correctly, passing the authenticated user's ID:

public function postSign(Request $request)
{
    $credentials = $request->only('email', 'password');

    if (Auth::attempt($credentials)) {
        // Redirect to the dashboard with the logged-in user's ID
        return redirect()->route('dashboard', ['user_id' => Auth::id()]);
    }

    // If login fails, send the user back with an error
    return back()->withErrors(['login' => 'Invalid email or password']);
}

If you're passing a random or incorrect user_id in the redirect, your middleware might reject the request and trigger the expired message.

Sometimes old cache or session files cause weird behavior—run these commands to reset things:

• php artisan config:clear (clears cached configuration)
• php artisan cache:clear (clears application cache)
• Delete all files in storage/framework/sessions/ (wipes stale session data)

内容的提问来源于stack exchange，提问作者user9461267