Laravel Socialite单设备登录策略：实现多设备会话管理

php artisan make:migration add_device_identifier_to_users_table --table=users

<?php

use Illuminate\Database\Migrations\Migration;
use Illuminate\Database\Schema\Blueprint;
use Illuminate\Support\Facades\Schema;

return new class extends Migration
{
    /**
     * Run the migrations.
     */
    public function up(): void
    {
        Schema::table('users', function (Blueprint $table) {
            // device_identifier 用于存储当前活跃设备的唯一标识
            // 可以是 UUID 或其他生成的字符串
            $table->string('device_identifier')->nullable()->after('remember_token');
        });
    }

    /**
     * Reverse the migrations.
     */
    public function down(): void
    {
        Schema::table('users', function (Blueprint $table) {
            $table->dropColumn('device_identifier');
        });
    }
};

php artisan migrate

<?php

namespace App\Http\Controllers\Auth;

use App\Http\Controllers\Controller;
use App\Models\User;
use Illuminate\Support\Facades\Auth;
use Illuminate\Support\Facades\Session;
use Illuminate\Support\Str; // 引入 Str 门面
use Laravel\Socialite\Facades\Socialite;

class SocialLoginController extends Controller
{
    /**
     * 重定向用户到 OAuth 提供商。
     *
     * @param string $provider
     * @return \Symfony\Component\HttpFoundation\RedirectResponse
     */
    public function redirectToProvider(string $provider)
    {
        return Socialite::driver($provider)->redirect();
    }

    /**
     * 从 OAuth 提供商获取用户信息。
     *
     * @param string $provider
     * @return \Illuminate\Http\RedirectResponse
     */
    public function handleProviderCallback(string $provider)
    {
        try {
            $socialUser = Socialite::driver($provider)->user();
        } catch (\Exception $e) {
            return redirect('/login')->withErrors(['social_login' => '无法通过 ' . ucfirst($provider) . ' 登录。请重试。']);
        }

        // 根据提供商ID查找或创建用户
        $user = User::where('provider', $provider)
                    ->where('provider_id', $socialUser->getId())
                    ->first();

        if (!$user) {
            // 如果用户不存在，则创建新用户
            $user = User::create([
                'name' => $socialUser->getName(),
                'email' => $socialUser->getEmail(),
                'provider' => $provider,
                'provider_id' => $socialUser->getId(),
                // 更多字段...
            ]);
        }

        // 生成一个新的设备标识符
        $newDeviceIdentifier = Str::uuid()->toString();

        // 更新用户表中的 device_identifier
        $user->device_identifier = $newDeviceIdentifier;
        $user->save();

        // 登录用户
        Auth::login($user, true); // 这里的 true 可以启用"记住我"功能，但需要注意其与单设备登录的交互

        // 将新的设备标识符存储到当前会话中
        Session::put('device_identifier', $newDeviceIdentifier);

        return redirect()->intended('/dashboard'); // 重定向到用户预期访问的页面
    }
}

php artisan make:middleware EnsureSingleDeviceLogin

<?php

namespace App\Http\Middleware;

use Closure;
use Illuminate\Http\Request;
use Illuminate\Support\Facades\Auth;
use Illuminate\Support\Facades\Session;
use Symfony\Component\HttpFoundation\Response;

class EnsureSingleDeviceLogin
{
    /**
     * 处理传入的请求。
     *
     * @param  \Closure(\Illuminate\Http\Request): (\Symfony\Component\HttpFoundation\Response)  $next
     */
    public function handle(Request $request, Closure $next): Response
    {
        if (Auth::check()) {
            $user = Auth::user();
            $sessionDeviceIdentifier = Session::get('device_identifier');

            // 检查数据库中的 device_identifier 是否与会话中的匹配
            // 如果不匹配，说明用户从其他设备登录，当前会话应失效
            if ($user->device_identifier !== $sessionDeviceIdentifier) {
                Auth::logout(); // 强制用户退出
                $request->session()->invalidate(); // 使会话无效
                $request->session()->regenerateToken(); // 重新生成CSRF令牌

                // 重定向到登录页并附带提示信息
                return redirect('/login')->withErrors(['single_device_login' => '您已从其他设备登录，当前会话已失效。请重新登录。']);
            }
        }

        return $next($request);
    }
}

protected array $middlewareAliases = [
    // ... 其他中间件
    'single_device_login' => \App\Http\Middleware\EnsureSingleDeviceLogin::class,
];

protected array $middlewareGroups = [
    'web' => [
        // ... 其他中间件
        \Illuminate\Cookie\Middleware\AddQueuedCookiesToResponse::class,
        \Illuminate\Session\Middleware\StartSession::class,
        // ...
        \App\Http\Middleware\EnsureSingleDeviceLogin::class, // 添加到这里
        \Illuminate\View\Middleware\ShareErrorsFromSession::class,
        \App\Http\Middleware\VerifyCsrfToken::class,
        \Illuminate\Routing\Middleware\SubstituteBindings::class,
    ],
    // ...
];

Route::middleware(['auth', 'single_device_login'])->group(function () {
    Route::get('/dashboard', [DashboardController::class, 'index']);
    // ... 其他需要认证和单设备登录验证的路由
});