auth()->guard('sanctum')->user() producing wrong user under specific condition

[mjzavar]

auth()->guard('sanctum')->user() producing wrong user under specific condition

[Muffinman]

Sanctum will check each guard in your config('sanctum.guard') value in turn, until one provides a valid user. It will do this as soon as the guard is invoked.

If none return a valid user, then personal_access_tokens are queried by the data provided in the Bearer request header. That ID query in your example comes from here:

    /**
     * Find the token instance matching the given token.
     *
     * @param  string  $token
     * @return static|null
     */
    public static function findToken($token)
    {
        if (strpos($token, '|') === false) {
            return static::where('token', hash('sha256', $token))->first();
        }

        [$id, $token] = explode('|', $token, 2);

        if ($instance = static::find($id)) {
            return hash_equals($instance->token, hash('sha256', $token)) ? $instance : null;
        }
    }

I don't believe the code above should ever call a query like

select * from `users` where `users`.`id` = ? and `users`.`deleted_at` is null limit 1

so my hunch is that you have customised the PeronsalAccessToken model and have other queries happening?

I think you would need to put this into a reproduction repo.

[crynobone]

Hey there, thanks for reporting this issue.

We'll need more info and/or code to debug this further. Can you please create a repository with the command below, commit the code that reproduces the issue as one separate commit on the main/master branch and share the repository here?

Please make sure that you have the latest version of the Laravel installer in order to run this command. Please also make sure you have both Git & the GitHub CLI tool properly set up.

laravel new bug-report --github="--public"

Do not amend and create a separate commit with your custom changes. After you've posted the repository, we'll try to reproduce the issue.

Thanks!

[driesvints]

Closing this issue because it's inactive, already solved, old or not relevant anymore. Feel to open up a new issue if you're still experiencing this.