Nsryjdtyk

Please I need a guide to solve this issue.

I have an application which sends an email notification to a user when he/she is registered on the application by the System Admin. The newly registered user is expected to click a link in the email and that should take him/her to the login page.

However, I realized that if the the System administrator is still logged in to the application when the newly registered user clicks the link in the email notification, clicking on that link in the email automatically takes the user to the dashboard and he/she is logged in as the System Admin that registered him/her.
There is middleware on the login controller as follows:

public function __construct()

{   

    $this->middleware('guest')->except('logout');

}

So, it does not permit a logged in user to get back to the login page. So when the newly created user clicks the link in his email, he is directed to the dashboard of the System Admin if he/she is still logged in.

I guess this is a session problem but I don't know how to resolve it. so I will appreciate any guide to resolve this.

Here is my login script.

<?php



    namespace AppHttpControllersAuth;



    use AppHttpControllersController;



    use IlluminateHttpRequest;

    use IlluminateFoundationAuthAuthenticatesUsers;



    use IlluminateSupportFacadesAuth;



    class LoginController extends Controller

    {

    /*

    |--------------------------------------------------------------------------

   | Login Controller

|--------------------------------------------------------------------------

|

| This controller handles authenticating users for the application and

| redirecting them to your home screen. The controller uses a trait

| to conveniently provide its functionality to your applications.

|

*/



use AuthenticatesUsers;



/**

 * Where to redirect users after login.

 *

 * @var string

 */

protected $redirectTo = '/dashboard';



/**

 * Create a new controller instance.

 *

 * @return void

 */

public function __construct()

{   

    $this->middleware('guest')->except('logout');

}



 /**

 * The user has been authenticated.

 * Therefore, load up his permissions in session

 *

 * @param  IlluminateHttpRequest  $request

 * @param  mixed  $user

 * @return mixed

 */

protected function loadUserRoutes($user)

{

    $userRoutes=collect();

    if(($user->role->routes)->isNotEmpty())

    {

        foreach($user->role->routes as $route)

        {

            $userRoutes->push($route->name);

        }

    }



    session(['userRoutes' => $userRoutes,'navbar'=>$user->role_id]);

}





/**

 * Send the response after the user was authenticated.

 *

 * @param  IlluminateHttpRequest  $request

 * @return IlluminateHttpResponse

 */

protected function sendLoginResponse(Request $request)

{

    $request->session()->regenerate();



    $this->clearLoginAttempts($request);

    $this->loadUserRoutes($this->guard()->user());



    return $this->authenticated($request, $this->guard()->user())

            ?: redirect()->intended($this->redirectPath());

}



/**

 * Attempt to log the user into the application.

 *

 * @param  IlluminateHttpRequest  $request

 * @return bool

 */

protected function attemptLogin(Request $request)

{

    return Auth::attempt(['email' => $request->email, 'password' => 

$request->password, 'active' => '1'], $request->filled('remember')

    );

  }

}

The notification is generated from a notification method in app/Notifications.
This is the code for the notification below

<?php



namespace AppNotifications;



use IlluminateBusQueueable;

use IlluminateNotificationsNotification;

use IlluminateContractsQueueShouldQueue;

use IlluminateNotificationsMessagesMailMessage;



class RegistrationSuccessful extends Notification implements ShouldQueue {



use Queueable;



/**

 * Create a new notification instance.

 *

 * @return void

 */



protected $password;

protected $name;



public function __construct($password, $name) 

{

    $this->password = $password;

    $this->name = $name;

}



/**

 * Get the notification's delivery channels.

 *

 * @param  mixed  $notifiable

 * @return array

 */

public function via($notifiable) 

{

    return ['mail'];

}



/**

 * Get the mail representation of the notification.

 *

 * @param  mixed  $notifiable

 * @return IlluminateNotificationsMessagesMailMessage

 */

public function toMail($notifiable) {

    $recipient_name = $this->name;

    $recipient_password = $this->password;

    $app_name = config('app.name');

    return (new MailMessage)

                    ->subject("Registration on $app_name")

                    ->greeting("Hello $recipient_name,")

                    ->line("We write to notify you that an account has been opened for you on $app_name")

                    ->line('Your login password is as follows:')

                    ->line("$recipient_password")

                    ->line('You can use this email and the password above to login via the link below')

                    ->action('Login here', url('/login'))

                    ->line('Please contact the head of I.T. department for more information!');

}



/**

 * Get the array representation of the notification.

 *

 * @param  mixed  $notifiable

 * @return array

 */

public function toArray($notifiable) {

    return [

            //

    ];

}



}

And I call it somewhere in the application as follows:

$user->notify(new RegistrationSuccessful($new_password, $user->name));

Thank you.

Try to login the new user from a different browser window or a different device. If you have a tab that is still logged in as admin then the browser will send the admin session cookie with any request in that browser window.

It's more of a browser thing than an application thing, but I don't think you need to worry about users on other devices getting access to the admin session.