Laravel注册后自动登录的最佳实践

<?php

namespace App\Http\Controllers;

use App\Models\User;
use Illuminate\Http\Request;
use Illuminate\Support\Facades\Auth;
use Illuminate\Support\Facades\Hash;
use Illuminate\Validation\Rule; // 用于更高级的验证规则

class AuthController extends Controller
{
    /**
     * 处理用户注册并自动登录。
     *
     * @param  \Illuminate\Http\Request  $request
     * @return \Illuminate\Http\RedirectResponse
     */
    public function registerAndLogin(Request $request)
    {
        // 1. 数据验证
        // 推荐使用 Form Request Validation 以保持控制器简洁，
        // 这里为了示例直接在控制器中进行。
        $request->validate([
            'name' => ['required', 'string', 'max:255'],
            'email' => ['required', 'string', 'email', 'max:255', Rule::unique('users')], // 确保邮箱唯一
            'phone' => ['required', 'string', 'regex:/^([0-9\s\-\+\(\)]*)$/', 'max:20'], // 电话号码验证
            'password' => ['required', 'string', 'min:8', 'confirmed'], // 密码至少8位，需要确认密码
        ]);

        // 2. 创建用户
        $user = User::create([
            'name' => $request->name,
            'email' => $request->email,
            'phone' => $request->phone,
            'password' => Hash::make($request->password), // 存储哈希后的密码
        ]);

        // 3. 自动登录新创建的用户
        Auth::login($user);

        // 4. 重定向到用户面板或指定页面
        $request->session()->regenerate(); // 重新生成会话ID以防止会话固定攻击
        return redirect()->route('panel'); // 假设你有一个名为 'panel' 的路由
    }
}

<?php

namespace App\Models;

use Illuminate\Contracts\Auth\MustVerifyEmail;
use Illuminate\Database\Eloquent\Factories\HasFactory;
use Illuminate\Foundation\Auth\User as Authenticatable;
use Illuminate\Notifications\Notifiable;
use Laravel\Sanctum\HasApiTokens;

class User extends Authenticatable
{
    use HasApiTokens, HasFactory, Notifiable;

    /**
     * The attributes that are mass assignable.
     *
     * @var array<int, string>
     */
    protected $fillable = [
        'name',
        'email',
        'phone', // 确保 'phone' 字段在此处
        'password',
    ];

    /**
     * The attributes that should be hidden for serialization.
     *
     * @var array<int, string>
     */
    protected $hidden = [
        'password',
        'remember_token',
    ];

    /**
     * The attributes that should be cast.
     *
     * @var array<string, string>
     */
    protected $casts = [
        'email_verified_at' => 'datetime',
    ];
}