The AuthenticateSession middleware assumes that the user has a password

[nhedger]

Sanctum Version

3.3.2

Laravel Version

10.33

PHP Version

8.2

Database Driver & Version

No response

Description

The AuthenticateSession middleware introduced in pull request #467 assumes that the user has a password, which may not always be the case. Think passwordless logins.

Happy to contribute a fix if you're down.

Steps To Reproduce

n/a

[crynobone]

I believe the AuthenticateSession is only meant for application where user has a password and you can disable it by setting it to null from sanctum.php config file:

'middleware' => [
-   'authenticate_session' => Laravel\Sanctum\Http\Middleware\AuthenticateSession::class,
+   'authenticate_session' => null,
    'encrypt_cookies' => App\Http\Middleware\EncryptCookies::class,
    'verify_csrf_token' => App\Http\Middleware\VerifyCsrfToken::class,
],

[nhedger]

Thanks, I'll it this way.