framework: 419 Error when logged in with multi auth if remember me is checked

Laravel Version: 5.5.19
PHP Version: 7.1.7
Database Driver & Version: MySQL 5.7.19

Description:

I have the following guards

'guards' => [
    'web' => [
        'driver' => 'session',
        'provider' => 'users',
    ],

    'admin' => [
        'driver' => 'session',
        'provider' => 'admins',
    ],

    'api' => [
        'driver' => 'passport',
        'provider' => 'users',
    ],
],

web for end-users admin for website administrators

each has his own auth and login/register pages and routes.

The issue is i get 419 error when i submit POSTs after i am logged in with the same email as a user (remember me is checked), and as an admin (remember me is checked too)

Steps To Reproduce:

Log in using web auth with remember me is checked
Log in again using admin auth with remember me is checked
Submit any form with POST method

About this issue

Original URL
State: closed
Created 6 years ago
Comments: 20 (6 by maintainers)

Most upvoted comments

For me the problem were cause of laravel-debugbar, this packages were caused to session regeneration on every request. I have multiple user types and I only have 1 session cookie, everything works as expected.

sharifzadesina on Dec 20, 2018

Same issue. Need to work simultaneously as admin(admin guard) on /admin/* and on front-end (web guard), without SCRF token conflict

Arduino1987 on Sep 18, 2018

Having the same issue. Are there any workarounds or fixes you guys came up with in the end?

bhulsman on Jun 7, 2018

@KeitelDOG Why at the first place we should have multiple sessions? we must have one session through whole app.

sharifzadesina on Dec 16, 2018

@Arduino1987 You might need to setup cookie => ... in session config with combined values to be unique for your admin and web, The browser behavior seems to create conflict with cookies with the same name, and the incorrect one seems to be passed to the request. I don’t really know how browsers handle cookies but I know they can have conflicts with them on requests. You can see my comment https://github.com/laravel/framework/issues/26106#issuecomment-444723768 from another issue that is similar.

KeitelDOG on Dec 6, 2018

I think it should be one session for both if “PHP does not support multiple sessions”. Anyway, how about setting different key prefix for each guard’s session?

Example:

    'guards' => [
        'web' => [
            'driver' => 'session',
            'driver_prefix' => 'user_',
            'provider' => 'users',
        ],

        'admin' => [
            'driver' => 'session',
            'driver_prefix' => 'admin_',
            'provider' => 'admins',
        ],
    ],

‘driver_prefix’ may be replaced with ‘provider’, so web guard session is named ‘users_session’ and ‘admins_session’ for admin guard.

I think it can be solved anyway.

Thanks @laurencei

HasanAlyazidi on Feb 20, 2018