Fix session authentication issues

[jszobody]

Laravel has a middleware AuthenticateSession that stores the password hash for the currently logged-in user. When impersonating, this hash obviously isn't going to match.

This is really something that 404labfr/laravel-impersonate should handle. There are multiple tickets on this issue:

404labfr/laravel-impersonate#134
404labfr/laravel-impersonate#154
404labfr/laravel-impersonate#162
404labfr/laravel-impersonate#156

... and others.

Making this issue trickier it that it seems Jetstream/Sanctum are storing the user and password hash in both the web and sanctum session keys. Clearing just the web hash isn't enough.

This PR now ensures the sanctum key is cleared, along with any other configured guards. I don't love this fix, and I'm still hoping that 404labfr/laravel-impersonate ultimately comes up with a better way to do impersonation with authenticated sessions. This isn't a Filament issue, and shouldn't be something this Filament package needs to handle.

[Piket564]

Hi, I don't think the problem has been resolved.
I keep getting logged out after I try to impersonate any user.
Below are some details:

web.php

Route::middleware(['auth:web', config('jetstream.auth_session'), 'verified',])->group(function () {
    Route::impersonate();
    /* other routes */
});

Livewire Function

public function ImpersonateUser($id = null)
    {
        if ($id != null) {
            session()->put(['impersonate' => $id]);
            Auth::user()->impersonate(User::find($id));
            $this->redirect(route('dashboard'));
        }
    }

app.php

    'providers' => ServiceProvider::defaultProviders()->merge([
        /*
         * Package Service Providers...
         */

        /*
         * Application Service Providers...
         */
        App\Providers\AppServiceProvider::class,
        App\Providers\AuthServiceProvider::class,
        // App\Providers\BroadcastServiceProvider::class,
        App\Providers\EventServiceProvider::class,
        App\Providers\RouteServiceProvider::class,
        App\Providers\FortifyServiceProvider::class,
        App\Providers\JetstreamServiceProvider::class,
        Lab404\Impersonate\ImpersonateServiceProvider::class,
    ])->toArray(),

composer.json

{
  "name": "laravel/laravel",
  "type": "project",
  "description": "The skeleton application for the Laravel framework.",
  "keywords": [
    "laravel",
    "framework"
  ],
  "license": "MIT",
  "require": {
    "php": "^8.1",
    "danielme85/laravel-log-to-db": "^4.0",
    "djokicpn/laravel-email-audit-log": "^1.0",
    "guzzlehttp/guzzle": "^7.2",
    "lab404/laravel-impersonate": "^1.7",
    "laravel/framework": "^10.10",
    "laravel/jetstream": "^4.0",
    "laravel/sanctum": "^3.2",
    "laravel/tinker": "^2.8",
    "livewire/livewire": "^3.0",
    "power-components/livewire-powergrid": "^5.1",
    "spatie/laravel-medialibrary": "^10.0.0",
    "spatie/laravel-permission": "^5.11",
    "wire-elements/modal": "^2.0",
    "wireui/wireui": "*"
  },
  "require-dev": {
    "barryvdh/laravel-debugbar": "^3.9",
    "fakerphp/faker": "^1.9.1",
    "laravel/pint": "^1.0",
    "laravel/sail": "^1.18",
    "mockery/mockery": "^1.4.4",
    "nunomaduro/collision": "^7.0",
    "phpunit/phpunit": "^10.1",
    "spatie/laravel-ignition": "^2.0"
  },
  "autoload": {
    "psr-4": {
      "App\\": "app/",
      "Database\\Factories\\": "database/factories/",
      "Database\\Seeders\\": "database/seeders/"
    },
    "exclude-from-classmap": [
      "vendor/livewire/livewire/src/Features/SupportLegacyModels/EloquentModelSynth.php"
    ],
    "files": [
      "app/Http/General.php",
      "app/Overrides/EloquentModelSynth.php"
    ]
  },
  "autoload-dev": {
    "psr-4": {
      "Tests\\": "tests/"
    }
  },
  "scripts": {
    "post-autoload-dump": [
      "Illuminate\\Foundation\\ComposerScripts::postAutoloadDump",
      "@php artisan package:discover --ansi"
    ],
    "post-update-cmd": [
      "@php artisan vendor:publish --tag=laravel-assets --ansi --force"
    ],
    "post-root-package-install": [
      "@php -r \"file_exists('.env') || copy('.env.example', '.env');\""
    ],
    "post-create-project-cmd": [
      "@php artisan key:generate --ansi"
    ]
  },
  "extra": {
    "laravel": {
      "dont-discover": []
    }
  },
  "config": {
    "optimize-autoloader": true,
    "preferred-install": "dist",
    "sort-packages": true,
    "allow-plugins": {
      "pestphp/pest-plugin": true,
      "php-http/discovery": true
    }
  },
  "minimum-stability": "stable",
  "prefer-stable": true
}

Any idea?

[jszobody]

@Piket564 This package is a filament plugin, and it doesn't look like you are using filament in your code. Perhaps you meant to open this ticket on 404labfr/laravel-impersonate?

[Piket564]

@Piket564 This package is a filament plugin, and it doesn't look like you are using filament in your code. Perhaps you meant to open this ticket on 404labfr/laravel-impersonate?

Yes, misclicked. Sorry.