Set password_confirmed_at on login

[tontonsb]

The current behaviour is such that when an unauthenticated user is accessing a confirmation-protected route, they are first asked to log in and then instantly asked to confirm the password. That confuses users and also is redundant as they just entered the password.

I have made the most straightforward solution here — explicitly set the password_confirmed_at timestamp as the user logs in.

[jansgescheit]

In my case, that's a breaking change. We use JWT and not the Session Store.

{
    "class": "RuntimeException",
    "message": "Session store not set on request.",
    "code": 0,
    "file": "/var/www/html/vendor/laravel/framework/src/Illuminate/Http/Request.php:502",
    "trace": [
        "/var/www/html/vendor/laravel/ui/auth-backend/AuthenticatesUsers.php:47",
        "..."
}

[arthurkirkosa]

I have the same problem :/

Added \Illuminate\Session\Middleware\StartSession::class to $middleware in Kernel.php while a better solution is found.

[tontonsb]

Sorry, I didn't consider this would cause issues with session disabled.

@jansgescheit @arthurkirkosa can you check if changing line 47 in vendor/laravel/ui/auth-backend/AuthenticatesUsers.php to this solves the issue?

        optional($request->getSession())->put('auth.password_confirmed_at', time());

Or we could do just explicit

        if ($request->hasSession())
            $request->session()->put('auth.password_confirmed_at', time());

[driesvints]

@tontonsb I'll get that fixed.

[arthurkirkosa]

It works with both variants

[driesvints]

Released v3.3.2 which should fix the issues here.

[jansgescheit]

@tontonsb 👍 for the explicit variant