Laravel Auth::attempt() 返回 false

问题描述

我是家庭爱好者，正在学习 Laravel，目前版本为 5.3.我使用的是 Mac，既不是 homestead 也不是 vagrant.

I am a home hobbyist and am studying Laravel, currently in version 5.3. I am using a Mac, neither homestead nor vagrant.

我目前正在开发一个使用登录名和注册系统来创建用户的网站.

I'm currently working on a website that uses a login and a register system to create users.

我使用 php artisan migrate 在本地操作我的数据库.

I've used php artisan migrate to manipulate my database locally.

如下所示，它包含三个字段，即:

As listed below, it has three fields, namely:

• 电子邮件
• 用户名
• 密码

我有一个 User 模型 (users.php):

I have a User model (users.php):

<?php

namespace blog;

use IlluminateNotificationsNotifiable;
use IlluminateDatabaseEloquentModel;
use IlluminateContractsAuthAuthenticatable;

class User extends Model implements Authenticatable {
    use IlluminateAuthAuthenticatable;

    use Notifiable;

    protected $fillable = [
        'username', 'email', 'password',
    ];

}

还有一个 UserController 类(UserController.php):

And also, a UserController class (UserController.php):

<?php

namespace blogHttpControllers;

use Auth;
use blogUser;
use IlluminateHttpRequest;

class UserController extends Controller {

    public function postRegister(Request $request) {
        $username = $request['username'];
        $email = $request['email'];
        $password = bcrypt($request['password']);

        $user = new User();
        $user->email = $email;
        $user->username = $username;
        $user->password = $password;

        $user->save();

        return redirect()->route('login');        
    }

    public function postLogin(Request $request) {

        $credentials = [
            'username' => $request['username'],
            'password' => $request['password'],
        ];

        if(Auth::attempt($credentials)) {
            return redirect()->route('dashboard');       
        }

        return 'Failure'; 
    }
}

?>

如您所见，我使用 bcrypt() 作为我的散列方法.

As you can see, I am using bcrypt() as my hashing method.

然而，这个问题是，它总是会导致失败.

However, this problem is, it will always result to a failure.

我检查了以下链接:

• 为什么是 Auth::attempt总是返回 false

Laravel authattempt 返回 false

附言这些链接似乎很难理解，因为我没有使用 Input 类.

P.S. These links seem very hard to follow as I do not utilize the Input class.

推荐答案

问题在于您在注册后将用户重定向到 login 路由的方式.您错误地假设 $request 数据将伴随重定向.

The problem is with the way you're redirecting the user to login route after the registration. You're falsely assuming that the $request data will be accompanied with the redirect.

让我们假设这个场景:一个请求被分派给 postRegister 方法，带有 name、email 和 password领域.控制器创建用户并将其保存到数据库中.然后它将尚未通过身份验证的用户重定向到 login 路由.postLogin 方法被触发，但这次没有请求数据.结果，Auth::attempt($credentials) 失败，你会在屏幕上看到令人讨厌的 Failure.

Let's assume this scenario: A request gets dispatched to the postRegister method with name, email and password fields. The controller creates the user and saves it into the database. Then it redirects the user, who is not yet authenticated, to the login route. The postLogin method gets triggered, but this time with no request data. As a result, Auth::attempt($credentials) fails and you get that nasty Failure on screen.

如果在创建数组后立即添加 dd($credentials)，您将看到它没有值:

If you add a dd($credentials) right after you create the array, you'll see that it has no values:

public function postLogin(Request $request)
{
    $credentials = [
        'username' => $request['username'],
        'password' => $request['password'],
    ];

    // Dump data
    dd($credentials);

    if (Auth::attempt($credentials)) {
        return redirect()->route('dashboard');
    }

    return 'Failure';
}

它会返回如下内容:

array:2 [
  "username" => null
  "password" => null
]

您不能使用自定义请求数据重定向(除非使用作为 URL 一部分的查询字符串)，无论怎样.这不是 HTTP 的工作方式.除了请求数据，您甚至无法使用自定义标头进行重定向.

You cannot redirect with custom request data (unless with querystring which is part of the URL), not matter what. It's not how HTTP works. Request data aside, you can't even redirect with custom headers.

既然您知道问题的根源是什么，让我们看看有哪些选项可以解决它.

Now that you know what's the root of your problem, let's see what are the options to fix it.

如果你想保留这个结构，你需要将 postRegister() 的请求数据刷入会话(在请求之间是持久的)，然后在 postLogin 中检索它() 方法使用 Session 门面、session() 助手或实际的 IlluminateSessionSessionManager 类.

In case you want to preserve this structure, you need to flash the request data of postRegister() into the session (which is persistent between requests) and then retrieve it in the postLogin() method using Session facade, session() helper or the actual IlluminateSessionSessionManager class.

我的意思是:
(我稍微修改了您的代码；删除了额外的变量，使其更简洁，等等.)

public function postRegister(Request $request)
{
    // Retrieve all request data including username, email & password.
    // I assume that the data IS validated.
    $input = $request->all();

    // Hash the password
    $input['password'] = bcrypt($input['password']);

    // Create the user
    User::create($input);

    // Redirect
    return redirect()
        // To the route named `login`
        ->route('login')

        // And flash the request data into the session,
        // if you flash the `$input` into the session, you'll
        // get a "Failure" message again. That's because the 
        // password in the $input array is already hashed and 
        // the attempt() method requires user's password, not 
        // the hashed copy of it. 
        //
        ->with($request->only('username', 'password'));
}

public function postLogin(Request $request)
{
    // Create the array using the values from the session
    $credentials = [
        'username' => session('username'),
        'password' => session('password'),
    ];

    // Attempt to login the user
    if (Auth::attempt($credentials)) {
        return redirect()->route('dashboard');
    }

    return 'Failure';
}

我强烈建议您不要使用这种方法.这样，应该负责登录用户的 postLogin() 方法的实现与会话数据耦合在一起，这是不好的.这样，您就无法独立于 postRegister 使用 postLogin.

I strongly recommend you against using this approach. This way the implementation of postLogin() method which is supposed to be responsible to login users gets coupled with session data which is not good. This way, you're not able to use postLogin independently from the postRegister.

这是一个稍微好一点的解决方案；如果您决定需要在注册后立即登录用户，为什么不这样做呢?

This is a slightly better solution; If you decided that you need to log in the user right after the registration, why not just doing that?

注意 Laravel 自己的身份验证控制器 noreferr="自动执行.

Note that Laravel's own authentication controller does it automatically.

顺便说一下，这就是我的意思:
(理想情况下，这应该分解为多个方法，就像 Laravel 自己的身份验证控制器一样.但这只是帮助您入门的示例.)

By the way, here's what I mean:
(Ideally this should be broken down into multiple methods, just like Laravel's own authentication controller. But it's just an example to get you started.)

public function postRegister(Request $request)
{
    $input = $request->all();

    $input['password'] = bcrypt($input['password']);

    User::create($input);

    // event(UserWasCreated::class);

    if (Auth::attempt($request->only('username', 'password'))) {
        return redirect()
            ->route('dashboard')
            ->with('Welcome! Your account has been successfully created!');
    }

    // Redirect
    return redirect()
        // To the previous page (probably the one generated by a `getRegister` method)
        ->back()
        // And with the input data (so that the form will get populated again)
        ->withInput();
}

但是，它仍然远非完美！有很多其他方法可以解决这个问题.一个可能是使用 events，抛出 异常 失败和使用自定义异常重定向.但我不打算探索它们，因为已经有为此完美设计的解决方案.

But still, it's far from perfect! There are many other ways to tackle this. One could be using events, throwing exceptions on failure and redirecting using custom exceptions. But I'm not gonna explore them as there's already a solution perfectly designed for this.

如果您想编写自己的身份验证控制器，那很好.一路上你会学到很多东西.但我强烈建议阅读 Laravel 自己的认证代码，尤其是 Users.php" rel="noreferrerRegistersUsers 和 AuthenticatesUsers 特征以便从中学习.

If you want to write your own authentication controller, that's fine. You'll learn a lot along the way. But I strongly suggest reading Laravel's own authentication code, especially RegistersUsers and AuthenticatesUsers traits in order to learn from it.

还有一张纸条；你不需要 IlluminateAuthAuthenticatable 特性在你的 User 模型中，因为它已经扩展了 Authenticatable 使用该特征.

And one more note; you don't need that IlluminateAuthAuthenticatable trait in your User model as it's already extending Authenticatable which use that trait.

这篇关于Laravel Auth::attempt() 返回 false的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持html5模板网！