SessionGuard
class SessionGuard implements StatefulGuard, SupportsBasicAuth
Traits
These methods are typically the same across all guards.
Properties
| protected UserProvider|null | $provider | The user provider implementation. |
from GuardHelpers |
| static protected array | $macros | The registered string macros. |
from Macroable |
| protected int | $rememberDuration | The number of minutes that the "remember me" cookie should be valid for. |
|
| protected QueueingFactory|null | $cookie | The Illuminate cookie creator service. |
|
| protected Dispatcher|null | $events | The event dispatcher instance. |
|
| protected Timebox | $timebox | The timebox instance. |
Methods
Determine if the current user is authenticated. If not, throw an exception.
Get the ID for the currently authenticated user.
Mix another object into the class.
Dynamically handle calls to the class.
Dynamically handle calls to the class.
Create a new authentication guard.
Get the currently authenticated user.
Pull a user from the repository by its "remember me" cookie token.
Log a user into the application without sessions or cookies.
Log the given user ID into the application without sessions or cookies.
Validate a user's credentials.
Attempt to authenticate using HTTP Basic Auth.
Perform a stateless HTTP Basic login attempt.
Attempt to authenticate using basic authentication.
Get the credential array for an HTTP Basic request.
Get the response for basic authentication.
Attempt to authenticate a user using the given credentials.
Attempt to authenticate a user with credentials and additional callbacks.
Determine if the user matches the credentials.
Determine if the user should login by executing the given callbacks.
Rehash the user's password if enabled and required.
Log the given user ID into the application.
Update the session with the given ID and regenerate the session's token.
Create a new "remember me" token for the user if one doesn't already exist.
Create a "remember me" cookie for a given ID.
Create a HMAC of the password hash for storage in cookies.
Log the user out of the application.
Log the user out of the application on their current device only.
Remove the user data from the session and cookies.
Invalidate other sessions for the current user.
Rehash the current user's password for logging out other devices via AuthenticateSession.
Register an authentication attempt event listener.
Fire the attempt event with the arguments.
Fire the login event if the dispatcher is set.
Fire the authenticated event if the dispatcher is set.
Fire the other device logout event if the dispatcher is set.
Fire the failed authentication attempt event with the given arguments.
Dispatch the given event if listeners are registered.
Get the last user we attempted to authenticate.
Get a unique identifier for the auth session value.
Get the name of the cookie used to store the "recaller".
Determine if the user was authenticated via "remember me" cookie.
Get the number of minutes the remember me cookie should be valid for.
Set the number of minutes the remember me cookie should be valid for.
Get the cookie creator instance used by the guard.
Get the event dispatcher instance.
Get the session store used by the guard.
Return the currently cached user.
Determine if the guard has a user instance.
Forget the current user.
Get durable authentication Context keys for the current guard.
Get the current request instance.
Get the timebox instance used by the guard.
Get a per-request state value from Context.
Set a per-request state value in Context.
Get a per-request state Context key.
Flush all static state.
Details
in
GuardHelpers at line 32
Authenticatable
authenticate()
Determine if the current user is authenticated. If not, throw an exception.
in
GuardHelpers at line 40
bool
check()
Determine if the current user is authenticated.
in
GuardHelpers at line 48
bool
guest()
Determine if the current user is a guest.
at line 234
int|string|null
id()
Get the ID for the currently authenticated user.
in
GuardHelpers at line 64
UserProvider|null
getProvider()
Get the user provider used by the guard.
in
GuardHelpers at line 75
void
setProvider(UserProvider $provider)
Set the user provider used by the guard.
Boot or tests only. The provider is stored on the worker-lifetime guard and affects every subsequent request.
in
Macroable at line 28
static void
macro(string $name, callable|object $macro)
Register a custom macro.
Boot-only. Macros persist in a static property for the worker lifetime and apply to every subsequent call on the macroable class.
in
Macroable at line 41
static void
mixin(object $mixin, bool $replace = true)
Mix another object into the class.
Boot-only. Delegates to macro() for each method; registered macros persist in a static property for the worker lifetime.
in
Macroable at line 57
static bool
hasMacro(string $name)
Check if macro is registered.
in
Macroable at line 68
static void
flushMacros()
Flush the existing macros.
Boot or tests only. Clears worker-wide macros; concurrent coroutines may resolve different methods depending on timing.
in
Macroable at line 78
static mixed
__callStatic(string $method, array $parameters)
Dynamically handle calls to the class.
in
Macroable at line 103
mixed
__call(string $method, array $parameters)
Dynamically handle calls to the class.
at line 97
__construct(string $name, UserProvider $provider, Session $session, Container $app, Timebox|null $timebox = null, bool $rehashOnLogin = true, int $timeboxDuration = 200000, string|null $hashKey = null)
Create a new authentication guard.
at line 124
Authenticatable|null
user()
Get the currently authenticated user.
The resolved user survives session rotation within the coroutine. Failed lookups are cached only for the session state they inspected.
at line 190
protected Authenticatable|null
userFromRecaller(Recaller $recaller)
Pull a user from the repository by its "remember me" cookie token.
at line 222
protected Recaller|null
recaller()
Get the decrypted recaller cookie for the request.
at line 248
bool
once(array $credentials = [])
Log a user into the application without sessions or cookies.
at line 268
Authenticatable|false
onceUsingId(mixed $id)
Log the given user ID into the application without sessions or cookies.
at line 282
bool
validate(array $credentials = [])
Validate a user's credentials.
at line 305
Response|null
basic(string $field = 'email', array $extraConditions = [])
Attempt to authenticate using HTTP Basic Auth.
at line 326
Response|null
onceBasic(string $field = 'email', array $extraConditions = [])
Perform a stateless HTTP Basic login attempt.
at line 340
protected bool
attemptBasic(Request $request, string $field, array $extraConditions = [])
Attempt to authenticate using basic authentication.
at line 355
protected array
basicCredentials(Request $request, string $field)
Get the credential array for an HTTP Basic request.
at line 365
protected never
failedBasicResponse()
Get the response for basic authentication.
at line 373
bool
attempt(array $credentials = [], bool $remember = false)
Attempt to authenticate a user using the given credentials.
at line 408
bool
attemptWhen(array $credentials = [], array|callable|null $callbacks = null, bool $remember = false)
Attempt to authenticate a user with credentials and additional callbacks.
at line 440
protected bool
hasValidCredentials(Authenticatable|null $user, array $credentials)
Determine if the user matches the credentials.
at line 454
protected bool
shouldLogin(array|callable|null $callbacks, Authenticatable $user)
Determine if the user should login by executing the given callbacks.
at line 468
protected void
rehashPasswordIfRequired(Authenticatable $user, array $credentials)
Rehash the user's password if enabled and required.
at line 478
Authenticatable|false
loginUsingId(mixed $id, bool $remember = false)
Log the given user ID into the application.
at line 492
void
login(Authenticatable $user, bool $remember = false)
Log a user into the application.
at line 520
protected void
updateSession(mixed $id)
Update the session with the given ID and regenerate the session's token.
at line 530
protected void
ensureRememberTokenIsSet(Authenticatable $user)
Create a new "remember me" token for the user if one doesn't already exist.
at line 540
protected void
queueRecallerCookie(Authenticatable $user)
Queue the recaller cookie into the cookie jar.
at line 552
protected Cookie
createRecaller(string $value)
Create a "remember me" cookie for a given ID.
at line 560
string
hashPasswordForCookie(string|null $passwordHash)
Create a HMAC of the password hash for storage in cookies.
at line 572
void
logout()
Log the user out of the application.
at line 600
void
logoutCurrentDevice()
Log the user out of the application on their current device only.
This method does not cycle the "remember" token.
at line 622
protected void
clearUserDataFromStorage()
Remove the user data from the session and cookies.
at line 638
protected void
cycleRememberToken(Authenticatable $user)
Refresh the "remember me" token for the user.
at line 652
Authenticatable|null
logoutOtherDevices(string $password)
Invalidate other sessions for the current user.
The application must be using the AuthenticateSession middleware.
at line 675
protected Authenticatable|null
rehashUserPasswordForDeviceLogout(string $password)
Rehash the current user's password for logging out other devices via AuthenticateSession.
at line 698
void
attempting(callable $callback)
Register an authentication attempt event listener.
Boot-only. Listener registrations persist on the worker-lifetime dispatcher and affect every subsequent request.
at line 706
protected void
fireAttemptEvent(array $credentials, bool $remember = false)
Fire the attempt event with the arguments.
at line 714
protected void
fireValidatedEvent(Authenticatable $user)
Fire the validated event if the dispatcher is set.
at line 722
protected void
fireLoginEvent(Authenticatable $user, bool $remember = false)
Fire the login event if the dispatcher is set.
at line 730
protected void
fireAuthenticatedEvent(Authenticatable $user)
Fire the authenticated event if the dispatcher is set.
at line 738
protected void
fireOtherDeviceLogoutEvent(Authenticatable $user)
Fire the other device logout event if the dispatcher is set.
at line 746
protected void
fireFailedEvent(Authenticatable|null $user, array $credentials)
Fire the failed authentication attempt event with the given arguments.
at line 754
protected void
dispatchIfListening(string $eventClass, Closure $event)
Dispatch the given event if listeners are registered.
at line 764
Authenticatable|null
getLastAttempted()
Get the last user we attempted to authenticate.
at line 772
string
getName()
Get a unique identifier for the auth session value.
at line 780
string
getRecallerName()
Get the name of the cookie used to store the "recaller".
at line 788
bool
viaRemember()
Determine if the user was authenticated via "remember me" cookie.
at line 796
protected int
getRememberDuration()
Get the number of minutes the remember me cookie should be valid for.
at line 807
SessionGuard
setRememberDuration(int $minutes)
Set the number of minutes the remember me cookie should be valid for.
Boot-only. The duration is stored on the worker-lifetime guard and affects every subsequent request.
at line 819
QueueingFactory
getCookieJar()
Get the cookie creator instance used by the guard.
at line 834
void
setCookieJar(QueueingFactory $cookie)
Set the cookie creator instance used by the guard.
Boot or tests only. The cookie jar is stored on the worker-lifetime guard and affects every subsequent request.
at line 842
Dispatcher|null
getDispatcher()
Get the event dispatcher instance.
at line 853
void
setDispatcher(Dispatcher $events)
Set the event dispatcher instance.
Boot or tests only. The dispatcher is stored on the worker-lifetime guard and affects every subsequent request.
at line 861
Session
getSession()
Get the session store used by the guard.
at line 869
Authenticatable|null
getUser()
Return the currently cached user.
at line 877
bool
hasUser()
Determine if the guard has a user instance.
at line 885
Guard
setUser(Authenticatable $user)
Set the current user.
at line 899
SessionGuard
forgetUser()
Forget the current user.
at line 915
array
getAuthContextKeys()
Get durable authentication Context keys for the current guard.
Failed lookups, remember-cookie attempts, and last-attempted users are transient request state and are intentionally excluded.
at line 929
Request
getRequest()
Get the current request instance.
Resolved lazily from the container because this guard is a process-global singleton and must not store per-request state.
at line 937
Timebox
getTimebox()
Get the timebox instance used by the guard.
at line 945
protected mixed
getContextState(string $key, mixed $default = null)
Get a per-request state value from Context.
at line 953
protected void
setContextState(string $key, mixed $value)
Set a per-request state value in Context.
at line 961
protected string
getContextStateKey(string $key)
Get a per-request state Context key.
at line 969
static void
flushState()
Flush all static state.