Laravel unexpected redirects ( 302 )

Question

I have started a new Laravel 5.2 project, using laravel new MyApp, and added authentication via php artisan make:auth. This is intended to be a members only website, where the first user is seeded, and creates the rest (no manual user creation/password reset/etc).

These are the routes I have currently defined:

 Route::group(['middleware' => 'web'], function () {   // Authentication Routes...   Route::get( 'user/login',  ['as' => 'user.login',     'uses' => 'Auth\AuthController@showLoginForm']);   Route::post('user/login',  ['as' => 'user.doLogin',   'uses' => 'Auth\AuthController@login'        ]);    Route::group(['middleware' => 'auth'], function() {     // Authenticated user routes     Route::get( '/', ['as'=>'home', 'uses'=> 'HomeController@index']);     Route::get( 'user/{uid?}', ['as' => 'user.profile',   'uses' => 'Auth\AuthController@profile' ]);     Route::get( 'user/logout', ['as' => 'user.logout',    'uses' => 'Auth\AuthController@logout'  ]);     Route::get( '/user/add',   ['as' => 'user.add',       'uses' => 'Auth\AuthController@showAddUser']);      [...]   }); }); 

I can login just fine, however I'm experiencing some very "funky" behavior - when I try to logout ( via the built-in logout method that was created via artisan ), the page does a 302 redirect to home, and I am still logged in.

What's more, while almost all pages (not listed here) work as expected, user.add also produces a 302 to the home page.

Do note the homepage is declared to the AuthController as $redirectTo, if that makes any difference

I found out about the redirects via the debugbar. Any idea on what to look for ?

Answer 1

I encountered an issue with 302 Redirects when posting ajax requests. The solution in this case was to remember to include the CSRF token.

See the Laravel 5.4 documents here: https://laravel.com/docs/5.4/csrf

Answer 2

After several hours of hair pulling, I have found my answer -- and it's silly.

The problem is that the route user.profile has a path user/{uid?} and it matches both user/logout and user/add as paths.

It being before the others, and not having a regex or similar, it handled the route.

I still don't know why a 302 was generated for that page, but found that moving it out of the AuthController and into the UserController (where it should be from the start) fixed the behavior.

Thus, my (amended and working) routes now look like so:

Route::group(['middleware' => 'web'], function () {   // Authentication Routes...   Route::get( 'user/login',  ['as' => 'user.login',     'uses' => 'Auth\AuthController@showLoginForm']);   Route::post('user/login',  ['as' => 'user.doLogin',   'uses' => 'Auth\AuthController@login'        ]);    Route::group(['middleware' => 'auth'], function() {     // Authenticated user routes     Route::get( '/',     ['as'=>'home', 'uses'=> 'HomeController@index']);     Route::get( '/home', ['as'=>'home', 'uses'=> 'HomeController@home']);     Route::get( 'user/logout', ['as' => 'user.logout',    'uses' => 'Auth\AuthController@logout'  ]);      // *** Added /profile/ here to prevent matching with other routes ****     Route::get( 'user/profile/{uid?}', ['as' => 'user.profile',   'uses' => 'UserController@profile' ]);     Route::get( '/user/add',           ['as' => 'user.add',       'uses' => 'UserController@showAddUser']);      [...]     }); });