2b2bb439a5
Where the console and the portal share a host (shared/fallback mode — this VM's own mode), both guards keep their login key in the SAME session. session()->invalidate() is flush() + migrate(true) — it discards every attribute in the session, not only the operator's, so signing out of the console silently signed a customer out of the portal too if the same browser carried both. Replaced with session()->regenerate(): a new session id, so there is no fixation risk, while attributes belonging to any other guard survive untouched. |
||
|---|---|---|
| .. | ||
| Feature | ||
| Support | ||
| Unit | ||
| Pest.php | ||
| TestCase.php | ||