[bennito254]

Hydration should not regenerate the session

What kind of change does this PR introduce? (pls check at least one)

• Bugfix
• Feature
• Code style update
• Refactor
• Build-related changes
• Other, please describe below

Description

Auth::user() was regenerating the session

Does this PR introduce a breaking change? (check one)

• Yes
• No

[mychidarko]

[BOT]

Thanks for this. Skipping the session_regenerate_id() on every Auth::user() call makes sense.

One side effect to check: passing false also skips the auth.lastActivity and auth.ttl updates, so user() no longer extends the session on each request. Apps that rely on that sliding expiry would see sessions end at the original TTL. I've left this for @mychidarko to decide whether that's the intended behaviour, or whether only the regenerate should be skipped.

CI hasn't run on this PR yet, so it's waiting on a maintainer to approve the workflow.

[mychidarko]

Thanks @bennito254. Passing $session = false stopped the regeneration, but it also skipped refreshing auth.lastActivity and auth.ttl, so active users would get logged out once the TTL ran out from login time.

I pushed a small change to your branch: User now takes a third $regenerate flag, and user() passes true, false. Sessions keep their sliding expiry and only the ID regeneration is skipped. This also fixes the lint failure.