Why has Fortify route for verifyfing an email address an auth middleware attached?

Question

I´m wondering why routes in Fortify which don´t require a user to be logged in has the auth middleware attached to it.

E.g. the Route to verify an E-Mail

Route::get(RoutePath::for('verification.verify', '/email/verify/{id}/{hash}'), [VerifyEmailController::class, '__invoke'])
            ->middleware([config('fortify.auth_middleware', 'auth') . ':' . config('fortify.guard'), 'signed', 'throttle:' . $verificationLimiter])
            ->name('verification.verify');

This leads to an "unauthenticated" response if no session cookie is set which doesn´t make much sense to me when a user has to verify his e-mail address via a link that has sent to him by email.

Jeyhun Rashidov · Accepted Answer · 2023-11-08 10:20:43Z

0

The reason for having the auth middleware in the email verification route might be to handle cases where users are trying to verify their email while being logged in. For instance, after registering, a user might stay logged in but not immediately verify their email. When they eventually click the verification link, the application can check if the currently logged-in user matches the ID in the verification link, which is a common approach to ensure that the correct user is verifying their email.

However, you are correct that this setup can cause issues if a logged-out user attempts to verify their email and hits the auth middleware, resulting in an "unauthenticated" response. To address this, the auth middleware should typically be configured to allow for guest access in the case of email verification, or the route should not include the auth middleware at all.

answered Nov 8, 2023 at 10:20

Jeyhun Rashidov

1,1781 gold badge8 silver badges20 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

Mike Over a year ago

I know what you mean. I think the best way - especially how I try to solve it - is to remove the auth middleware from the route. I couldn't find any downsides on this so far...

Collectives™ on Stack Overflow

Why has Fortify route for verifyfing an email address an auth middleware attached?

1 Answer 1

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related