I am trying to set a custom message when a user session has timed out. I managed to setup the timeout rerouting, but I struggle to include a message to notify the user. Here’s part of the code that I believe is relevant:
composer.json
"require": {
"php": "^8.2",
"laravel/framework": "^11.9",
"laravel/tinker": "^2.9",
"laravel/ui": "^4.5"
},
"require-dev": {
"laravel/breeze": "^2.1"
}
login.blade.php
<!DOCTYPE html>
<html lang="en">
<head>
<link rel="stylesheet" href="{{ mix('style.css') }}">
</head>
<body>
<section>
<div id="form-container">
<form action="{{ route('login.submit') }}" method="POST">
...
</form>
</div>
</section>
@if(session('error'))
<div class="alert alert-danger">
{{ session('error') }}
</div>
@else
<p>no problem here.</p>
@endif
</body>
</html>
**
CheckSessionTimeout.php** (middleware)
<?php
namespace AppHttpMiddleware;
use Closure;
use IlluminateHttpRequest;
use SymfonyComponentHttpFoundationResponse;
use IlluminateSupportFacadesAuth;
use IlluminateSupportFacadesLog;
class CheckSessionTimeout
{
public function handle(Request $request, Closure $next): Response
{
if (Auth::check()) {
$lastActivityTime = $request->session()->get('lastActivityTime', time());
$sessionTimeout = config('session.lifetime') * 60;
if (time() - $lastActivityTime > $sessionTimeout) {
Auth::guard('web')->logout();
$request->session()->invalidate();
$request->session()->regenerateToken();
return redirect()->route('login')->with('error', 'Your session has expired. Please log in again.');
}
$request->session()->put('lastActivityTime', time());
}
return $next($request);
}
}
web.php (routing)
<?php
use IlluminateSupportFacadesRoute;
use AppHttpControllersProfileController;
use AppHttpControllersLoginController;
use AppHttpControllersRosterController;
use AppHttpControllersAuthAuthenticatedSessionController;
use AppHttpMiddlewareCheckSessionTimeout;
require __DIR__.'/auth.php';
Route::get('/login', function () {
return view('login');
})->name('login');
Route::post('/login', [LoginController::class, 'login']
)->name('login.submit');
Route::middleware([CheckSessionTimeout::class])->group(function () {
...
Route::middleware('auth')->group(function () {
Route::post('/logout', [AuthenticatedSessionController::class, 'destroy']
)->name('logout');
});
});
I would like to briefly address my ideal output and current outcome:
Ideal: After a user session timed out, the next request will always go to login.php view, with extra message that informs the user their session has timed out.
Outcome: The user did get redirect to login.php, but the message never shows.
I tried working with ChatGPT before asking this, all the suggestion are:
Session Lifetime Configuration: I set a fixed duration and I can consistently trigger timeout.
Middleware Execution: I reviewed my middleware code over and over again, and approved by ChatGPT.
Session Flash Mechanism: It kepts suggesting between ->flash() and ->with(), I am currently using the latter
Middleware Order: I reviewed my code over and over again as well, and no apparent issues.