Proposition: Use getRouteKey() on EmailVerificationRequest

[ignacio-dev]

It would make sense if the EmailVerificationRequest class used $this->user->getRouteKey() instead of $this->user->getKey() on the authorize method.

That way, the id would reflect changes made for that method, like when using hashids.

Any thoughts? Something like this:

public function authorize(): bool
{
    if (! hash_equals((string) $this->user()->getRouteKey(), (string) $this->route('id'))) {
        return false;
    }

    if (! hash_equals(sha1($this->user()->getEmailForVerification()), (string) $this->route('hash'))) {
        return false;
    }

    return true;
}

The url made on the VerifyEmail notification would also have to be updated:

return URL::temporarySignedRoute(
    'verification.verify',
    Carbon::now()->addMinutes(Config::get('auth.verification.expire', 60)),
    [
        'id' => $notifiable->getRouteKey(),
        'hash' => sha1($notifiable->getEmailForVerification()),
    ]
);