Merge pull request #94 from thedevdojo/Fix-login-vulnerabilities

Fix login vulnerabilities
thedevdojo · Jul 12, 2024 · 7c3c85f · 7c3c85f
2 parents 4846892 + ea968c7
commit 7c3c85f
Show file tree

Hide file tree

Showing 2 changed files with 4 additions and 0 deletions.
diff --git a/resources/views/pages/auth/login.blade.php b/resources/views/pages/auth/login.blade.php
@@ -108,8 +108,10 @@ public function authenticate()
             event(new Login(auth()->guard('web'), $this->userModel->where('email', $this->email)->first(), true));
 
             if(session()->get('url.intended') != route('logout.get')){
+                session()->regenerate();
                 redirect()->intended(config('devdojo.auth.settings.redirect_after_auth'));
             } else {
+                session()->regenerate();
                 return redirect(config('devdojo.auth.settings.redirect_after_auth'));
             }
         }

diff --git a/resources/views/pages/auth/register.blade.php b/resources/views/pages/auth/register.blade.php
@@ -108,8 +108,10 @@ public function register()
         }
 
         if (session()->get('url.intended') != route('logout.get')) {
+            session()->regenerate();
             redirect()->intended(config('devdojo.auth.settings.redirect_after_auth'));
         } else {
+            session()->regenerate();
             return redirect(config('devdojo.auth.settings.redirect_after_auth'));
         }
     }