Skip to content

Roadrunner always store user on single worker, and after manually delete browser cookie, it's still logged in #1084

@juntralala

Description

@juntralala

Octane Version

2.13

Laravel Version

12.39.0

PHP Version

8.3.6

What server type are you using?

Roadrunner

Server Version

2.6

Database Driver & Version

mysql 8.0.43

Description

doing login and the result is, sometimes the see i'm as logged in and sometime not.

I am manualy making auth, the login like this:

<?php

namespace App\Http\Controllers\Auth;

use App\Dto\LoginDto;
use App\Http\Controllers\Controller;
use App\Http\Requests\LoginRequest;
use App\Service\LoginService;
use Illuminate\Auth\Access\AuthorizationException;
use Illuminate\Http\Request;
use Illuminate\Support\Facades\Auth;
use Inertia\Inertia;

class LoginController extends Controller
{

    public function __construct(
        private LoginService $loginService
    ) {
    }

    public function page()
    {
        return Inertia::render("auth/Login");
    }

    public function login(LoginRequest $request)
    {
        $safe = $request->safe();
        /* @var User|null */
        $user = $this->loginService->login(new LoginDto($safe->username, $safe->password));
        if (!$user) {
            return back()->withErrors([
                'username' => 'Username atau Password Salah',
                'password' => 'Username atau Password Salah',
            ]);
        }
        $request->session()->regenerate();
        Auth::login($user);
        return redirect()->route('home');
    }
}

and to debug what happened i'm trying make this:

Route::get("/inspect", function (Request $request) {
    return response()->json([
        'user' => $request->user(),
        'session' => $request->session()->all()
    ]);
});

and you know, i'm had trying refresh on /inspect multiple time, and i see that the $user is sometime exists and some time not.
I suspect that the issue from the roadrunner that store $user with Auth::login($user) persistently in single worker and not making other worker had access to the $user (why i say it store persistenly, cause i'm already doing experiment, when i delete all cookie from browser manually then i'm still loggen in).

Steps To Reproduce

just try making login as usually with Auth::login() on octane + roadrunner.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions