Auth implementation details

[yarosdev]

I have checked out a code of auth, regards Session Guard, when using "remember me" it writes to the cookie "recaller " three values: id, token and pwd hash. And my question is why it sends password hash to the browser and even don't use it anywhere ?

[ImBIOS]

@yarosdev Can you provide some code or screenshots?

[yarosdev]

Here is

[yarosdev]

$user->getAuthPassword

[JurianArie]

The AuthenticateSession middleware compares the current hash with the hash from the cookie whenever the user was logged in via the recaller.

framework/src/Illuminate/Session/Middleware/AuthenticateSession.php

Line 46 in 48afe79

if (! $passwordHash || $passwordHash != $request->user()->getAuthPassword()) {

[yarosdev]

I got it, thank you