From 6c81a372bc73a97cc88d980a89e10f6505c065af Mon Sep 17 00:00:00 2001
From: Ben Muriithi <6911766+bennito254@users.noreply.github.com>
Date: Thu, 29 Oct 2026 12:57:23 +0000
Subject: [PATCH 1/2] Fix Auth::user() in Auth.php

Hydration should not regenerate the session
---
 src/Auth.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/Auth.php b/src/Auth.php
index 34968be..de48dfa 100644
--- a/src/Auth.php
+++ b/src/Auth.php
@@ -750,7 +750,7 @@ public function user()
         }
 
         return $this->user = (new User(
-            $user
+            $user, false
         ))->setDb($this->db);
     }
 

From 9a6397ff75ad34d1622852eb5fc6419873c5bf69 Mon Sep 17 00:00:00 2001
From: William <william@leafphp.dev>
Date: Thu, 5 Nov 2026 21:12:00 +0000
Subject: [PATCH 2/2] fix: keep sliding session expiry, only skip session id
 regeneration in user()

---
 src/Auth.php      | 4 +++-
 src/Auth/User.php | 7 +++++--
 2 files changed, 8 insertions(+), 3 deletions(-)

diff --git a/src/Auth.php b/src/Auth.php
index de48dfa..67f7958 100644
--- a/src/Auth.php
+++ b/src/Auth.php
@@ -750,7 +750,9 @@ public function user()
         }
 
         return $this->user = (new User(
-            $user, false
+            $user,
+            true,
+            false
         ))->setDb($this->db);
     }
 
diff --git a/src/Auth/User.php b/src/Auth/User.php
index 5428d73..b69eef3 100644
--- a/src/Auth/User.php
+++ b/src/Auth/User.php
@@ -64,8 +64,9 @@ class User
     /**
      * @param array<string, mixed> $data
      * @param bool $session
+     * @param bool $regenerate
      */
-    public function __construct($data, $session = true)
+    public function __construct($data, $session = true, $regenerate = true)
     {
         $this->data = $data;
 
@@ -79,7 +80,9 @@ public function __construct($data, $session = true)
                 session_start();
             }
 
-            session_regenerate_id();
+            if ($regenerate) {
+                session_regenerate_id();
+            }
 
             if (!Session::has('auth.startedAt')) {
                 Session::set('auth.startedAt', time());