I am using an existing database, and I'm not allowed to modify the tables, so adding a remember_token is not an option, but without it I'm unable to login. When I try to login Laravel does check the credentials and returns whether they match the records, but it only refreshes the page. I am pretty sure the remember_token is the cause since I've encountered this problem before, but this time I can't add a column to my users table.
Is there a way to use the out-of-the-box authentication without the remember_token?
In your User model add:
/**
* Overrides the method to ignore the remember token.
*/
public function setAttribute($key, $value)
{
$isRememberTokenAttribute = $key == $this->getRememberTokenName();
if (!$isRememberTokenAttribute)
{
parent::setAttribute($key, $value);
}
}
Credits: https://laravel.io/forum/05-21-2014-how-to-disable-remember-token
Since Laravel v5.3.27 you can also disable the remember me functionality by setting the $rememberTokenName to false in your User model.
class User extends Authenticatable
{
use Notifiable;
protected $rememberTokenName = false;
// ...
}
source: this commit
In order to really disable the "remember me" functionality and to be sure the remember_token field is not used, add the following code to the boot method of App\Providers\AuthServiceProvider.
Auth::provider('eloquent', function($app, array $config)
{
return new class($app['hash'], $config['model']) extends \Illuminate\Auth\EloquentUserProvider
{
public function retrieveByToken($identifier, $token)
{
return null;
}
public function updateRememberToken(\Illuminate\Contracts\Auth\Authenticatable $user, $token)
{
//Do nothing
}
};
});
assuming a default Laravel setup, the code above will work instantly.
Off course, it can be improved by defining the custom user provider in a seperate file instead of using a anonymous class.