Laravel注册后自动登录的最佳实践与常见陷阱

<?php

namespace App\Http\Controllers;

use App\Models\User;
use Illuminate\Http\Request;
use Illuminate\Support\Facades\Auth;
use Illuminate\Support\Facades\Hash;
use Illuminate\Validation\ValidationException; // 引入ValidationException

class RegistrationController extends Controller
{
    /**
     * 处理用户注册请求并自动登录。
     *
     * @param  \Illuminate\Http\Request  $request
     * @return \Illuminate\Http\RedirectResponse
     */
    public function register(Request $request)
    {
        try {
            // 1. 验证用户输入数据
            $request->validate([
                'name' => 'required|string|max:64',
                'phone' => 'required|regex:/^([0-9\s\-\+\(\)]*)$/',
                'password' => 'required|string|min:8|max:64|confirmed', // 增加密码确认
                'email' => 'required|email|max:64|unique:users', // 邮箱唯一性检查
            ]);
        } catch (ValidationException $e) {
            // 验证失败时返回，并附带错误信息
            return back()->withErrors($e->errors())->withInput();
        }

        // 2. 创建用户实例
        $user = User::create([
            'name' => $request->name,
            'email' => $request->email,
            'phone' => $request->phone,
            'password' => Hash::make($request->password), // 确保密码被哈希
        ]);

        // 3. 直接登录新创建的用户
        Auth::login($user);

        // 4. 重生会话ID以防止会话固定攻击
        $request->session()->regenerate();

        // 5. 重定向到用户面板
        return redirect()->route('panel');
    }
}

php artisan make:request RegisterUserRequest

<?php

namespace App\Http\Requests;

use Illuminate\Foundation\Http\FormRequest;

class RegisterUserRequest extends FormRequest
{
    /**
     * 确定用户是否有权发出此请求。
     *
     * @return bool
     */
    public function authorize()
    {
        return true; // 如果不需要特定授权，通常设置为 true
    }

    /**
     * 获取适用于请求的验证规则。
     *
     * @return array
     */
    public function rules()
    {
        return [
            'name' => 'required|string|max:64',
            'phone' => 'required|regex:/^([0-9\s\-\+\(\)]*)$/',
            'password' => 'required|string|min:8|max:64|confirmed',
            'email' => 'required|email|max:64|unique:users',
        ];
    }

    /**
     * 自定义验证消息（可选）。
     *
     * @return array
     */
    public function messages()
    {
        return [
            'email.unique' => '该邮箱已被注册。',
            // 更多自定义消息
        ];
    }
}

<?php

namespace App\Http\Controllers;

use App\Models\User;
use Illuminate\Http\Request; // 仍然需要引入 Request 如果有其他 Request 操作
use Illuminate\Support\Facades\Auth;
use Illuminate\Support\Facades\Hash;
use App\Http\Requests\RegisterUserRequest; // 引入自定义的 Form Request

class RegistrationController extends Controller
{
    /**
     * 处理用户注册请求并自动登录。
     *
     * @param  \App\Http\Requests\RegisterUserRequest  $request
     * @return \Illuminate\Http\RedirectResponse
     */
    public function register(RegisterUserRequest $request)
    {
        // 验证已由 RegisterUserRequest 处理，如果验证失败，会自动重定向并显示错误
        // $request->validated() 方法返回所有通过验证的数据
        $validatedData = $request->validated();

        $user = User::create([
            'name' => $validatedData['name'],
            'email' => $validatedData['email'],
            'phone' => $validatedData['phone'],
            'password' => Hash::make($validatedData['password']),
        ]);

        Auth::login($user);
        $request->session()->regenerate();

        return redirect()->route('panel');
    }
}