SessionGuard
class SessionGuard implements StatefulGuard, SupportsBasicAuth
Traits
These methods are typically the same across all guards.
Properties
| protected null|TProvider | $provider | The user provider implementation. |
from GuardHelpers |
| static protected array | $macros | The registered string macros. |
from Macroable |
| protected int | $rememberDuration | The number of minutes that the "remember me" cookie should be valid for. |
|
| protected QueueingFactory|null | $cookie | The Illuminate cookie creator service. |
|
| protected Dispatcher|null | $events | The event dispatcher instance. |
|
| protected Timebox | $timebox | The timebox instance. |
Methods
Determine if the current user is authenticated. If not, throw an exception.
Get the ID for the currently authenticated user.
Get this guard's coroutine context key for the given entry.
Mix another object into the class.
Dynamically handle calls to the class.
Dynamically handle calls to the class.
Create a new authentication guard.
Get the currently authenticated user.
Pull a user from the repository by its "remember me" cookie token.
Log a user into the application without sessions or cookies.
Log the given user ID into the application without sessions or cookies.
Validate a user's credentials.
Attempt to authenticate using HTTP Basic Auth.
Perform a stateless HTTP Basic login attempt.
Attempt to authenticate using basic authentication.
Get the credential array for an HTTP Basic request.
Get the response for basic authentication.
Attempt to authenticate a user using the given credentials.
Attempt to authenticate a user with credentials and additional callbacks.
Determine if the user matches the credentials.
Determine if the user should login by executing the given callbacks.
Rehash the user's password if enabled and required.
Log the given user ID into the application.
Update the session with the given ID and regenerate the session's token.
Create a new "remember me" token for the user if one doesn't already exist.
Create a "remember me" cookie for a given ID.
Create a HMAC of the password hash for storage in cookies.
Log the user out of the application.
Log the user out of the application on their current device only.
Remove the user data from the session and cookies.
Invalidate other sessions for the current user.
Rehash the current user's password for logging out other devices via AuthenticateSession.
Register an authentication attempt event listener.
Fire the attempt event with the arguments.
Fire the login event if the dispatcher is set.
Fire the authenticated event if the dispatcher is set.
Fire the other device logout event if the dispatcher is set.
Fire the failed authentication attempt event with the given arguments.
Dispatch the given event if listeners are registered.
Get the last user we attempted to authenticate.
Get a unique identifier for the auth session value.
Get the name of the cookie used to store the "recaller".
Determine if the user was authenticated via "remember me" cookie.
Get the number of minutes the remember me cookie should be valid for.
Set the number of minutes the remember me cookie should be valid for.
Get the cookie creator instance used by the guard.
Get the event dispatcher instance.
Get the session store used by the guard.
Return the currently cached user.
Determine if the guard has a user instance.
Forget the current user.
Get durable authentication Context keys for the current guard.
Get the current request instance.
Get the timebox instance used by the guard.
Get a per-request state value from Context.
Set a per-request state value in Context.
Flush all static state.
Details
in
GuardHelpers at line 55
Authenticatable
authenticate()
Determine if the current user is authenticated. If not, throw an exception.
in
GuardHelpers at line 63
bool
check()
Determine if the current user is authenticated.
in
GuardHelpers at line 71
bool
guest()
Determine if the current user is a guest.
at line 236
int|string|null
id()
Get the ID for the currently authenticated user.
in
GuardHelpers at line 89
UserProvider|null
getProvider()
Get the user provider used by the guard.
in
GuardHelpers at line 102
void
setProvider(UserProvider $provider)
Set the user provider used by the guard.
The provider is stored on the worker-lifetime guard and affects every subsequent request.
in
GuardHelpers at line 111
protected string
contextKey(string $key)
Get this guard's coroutine context key for the given entry.
in
Macroable at line 30
static void
macro(string $name, callable|object $macro)
Register a custom macro.
Macros persist in a static property for the worker lifetime and apply to every subsequent call on the macroable class.
in
Macroable at line 44
static void
mixin(object $mixin, bool $replace = true)
Mix another object into the class.
Delegates to macro() for each method; registered macros persist in a static property for the worker lifetime.
in
Macroable at line 61
static bool
hasMacro(string $name)
Check if macro is registered.
in
Macroable at line 72
static void
flushMacros()
Flush the existing macros.
Clears worker-wide macros; concurrent coroutines may resolve different methods depending on timing.
in
Macroable at line 83
static mixed
__callStatic(string $method, array $parameters)
Dynamically handle calls to the class.
in
Macroable at line 108
mixed
__call(string $method, array $parameters)
Dynamically handle calls to the class.
at line 99
__construct(string $name, UserProvider $provider, Session $session, Container $app, Timebox|null $timebox = null, bool $rehashOnLogin = true, int $timeboxDuration = 200000, string|null $hashKey = null)
Create a new authentication guard.
at line 126
Authenticatable|null
user()
Get the currently authenticated user.
The resolved user survives session rotation within the coroutine. Failed lookups are cached only for the session state they inspected.
at line 192
protected Authenticatable|null
userFromRecaller(Recaller $recaller)
Pull a user from the repository by its "remember me" cookie token.
at line 224
protected Recaller|null
recaller()
Get the decrypted recaller cookie for the request.
at line 250
bool
once(array $credentials = [])
Log a user into the application without sessions or cookies.
at line 270
Authenticatable|false
onceUsingId(mixed $id)
Log the given user ID into the application without sessions or cookies.
at line 284
bool
validate(array $credentials = [])
Validate a user's credentials.
at line 307
Response|null
basic(string $field = 'email', array $extraConditions = [])
Attempt to authenticate using HTTP Basic Auth.
at line 328
Response|null
onceBasic(string $field = 'email', array $extraConditions = [])
Perform a stateless HTTP Basic login attempt.
at line 342
protected bool
attemptBasic(Request $request, string $field, array $extraConditions = [])
Attempt to authenticate using basic authentication.
at line 357
protected array
basicCredentials(Request $request, string $field)
Get the credential array for an HTTP Basic request.
at line 367
protected never
failedBasicResponse()
Get the response for basic authentication.
at line 375
bool
attempt(array $credentials = [], bool $remember = false)
Attempt to authenticate a user using the given credentials.
at line 410
bool
attemptWhen(array $credentials = [], array|callable|null $callbacks = null, bool $remember = false)
Attempt to authenticate a user with credentials and additional callbacks.
at line 442
protected bool
hasValidCredentials(Authenticatable|null $user, array $credentials)
Determine if the user matches the credentials.
at line 456
protected bool
shouldLogin(array|callable|null $callbacks, Authenticatable $user)
Determine if the user should login by executing the given callbacks.
at line 470
protected void
rehashPasswordIfRequired(Authenticatable $user, array $credentials)
Rehash the user's password if enabled and required.
at line 480
Authenticatable|false
loginUsingId(mixed $id, bool $remember = false)
Log the given user ID into the application.
at line 494
void
login(Authenticatable $user, bool $remember = false)
Log a user into the application.
at line 534
protected void
updateSession(mixed $id)
Update the session with the given ID and regenerate the session's token.
at line 544
protected void
ensureRememberTokenIsSet(Authenticatable $user)
Create a new "remember me" token for the user if one doesn't already exist.
at line 554
protected void
queueRecallerCookie(Authenticatable $user)
Queue the recaller cookie into the cookie jar.
at line 566
protected Cookie
createRecaller(string $value)
Create a "remember me" cookie for a given ID.
at line 574
string
hashPasswordForCookie(string|null $passwordHash)
Create a HMAC of the password hash for storage in cookies.
at line 586
void
logout()
Log the user out of the application.
at line 614
void
logoutCurrentDevice()
Log the user out of the application on their current device only.
This method does not cycle the "remember" token.
at line 636
protected void
clearUserDataFromStorage()
Remove the user data from the session and cookies.
at line 652
protected void
cycleRememberToken(Authenticatable $user)
Refresh the "remember me" token for the user.
at line 666
void
logoutOtherDevices(string $password)
Invalidate other sessions for the current user.
The application must be using the AuthenticateSession middleware.
at line 692
protected void
rehashUserPasswordForDeviceLogout(string $password)
Rehash the current user's password for logging out other devices via AuthenticateSession.
at line 713
void
attempting(callable $callback)
Register an authentication attempt event listener.
When the dispatcher is the application's worker-shared dispatcher, listener registrations persist and affect every subsequent request.
at line 721
protected void
fireAttemptEvent(array $credentials, bool $remember = false)
Fire the attempt event with the arguments.
at line 729
protected void
fireValidatedEvent(Authenticatable $user)
Fire the validated event if the dispatcher is set.
at line 737
protected void
fireLoginEvent(Authenticatable $user, bool $remember = false)
Fire the login event if the dispatcher is set.
at line 745
protected void
fireAuthenticatedEvent(Authenticatable $user)
Fire the authenticated event if the dispatcher is set.
at line 753
protected void
fireOtherDeviceLogoutEvent(Authenticatable $user)
Fire the other device logout event if the dispatcher is set.
at line 761
protected void
fireFailedEvent(Authenticatable|null $user, array $credentials)
Fire the failed authentication attempt event with the given arguments.
at line 769
protected void
dispatchIfListening(string $eventClass, Closure $event)
Dispatch the given event if listeners are registered.
at line 779
Authenticatable|null
getLastAttempted()
Get the last user we attempted to authenticate.
at line 787
string
getName()
Get a unique identifier for the auth session value.
at line 795
string
getRecallerName()
Get the name of the cookie used to store the "recaller".
at line 803
bool
viaRemember()
Determine if the user was authenticated via "remember me" cookie.
at line 811
protected int
getRememberDuration()
Get the number of minutes the remember me cookie should be valid for.
at line 824
SessionGuard
setRememberDuration(int $minutes)
Set the number of minutes the remember me cookie should be valid for.
The duration is stored on the worker-lifetime guard and affects every subsequent request.
at line 837
QueueingFactory
getCookieJar()
Get the cookie creator instance used by the guard.
at line 852
void
setCookieJar(QueueingFactory $cookie)
Set the cookie creator instance used by the guard.
The cookie jar is stored on the worker-lifetime guard and affects every subsequent request.
at line 861
Dispatcher|null
getDispatcher()
Get the event dispatcher instance.
at line 872
void
setDispatcher(Dispatcher $events)
Set the event dispatcher instance.
The dispatcher is stored on the worker-lifetime guard and affects every subsequent request.
at line 881
Session
getSession()
Get the session store used by the guard.
at line 889
Authenticatable|null
getUser()
Return the currently cached user.
at line 897
bool
hasUser()
Determine if the guard has a user instance.
at line 907
Guard
setUser(Authenticatable $user)
Set the current user.
at line 923
SessionGuard
forgetUser()
Forget the current user.
at line 939
array
getAuthContextKeys()
Get durable authentication Context keys for the current guard.
Failed lookups, remember-cookie attempts, and last-attempted users are transient request state and are intentionally excluded.
at line 953
Request
getRequest()
Get the current request instance.
Resolved lazily from the container because this guard is a process-global singleton and must not store per-request state.
at line 961
Timebox
getTimebox()
Get the timebox instance used by the guard.
at line 969
protected mixed
getContextState(string $key, mixed $default = null)
Get a per-request state value from Context.
at line 977
protected void
setContextState(string $key, mixed $value)
Set a per-request state value in Context.
at line 985
static void
flushState()
Flush all static state.