Session migration does not work with user UUID id

[Miosame]

• Laravel Version: 8.7.1
• PHP Version: 7.4.11
• Database Driver & Version: mysql - latest

Description:

I wanted to report this first before making a PR to the docs, to understand if my proposed solution is not in line with how it should be done or if this is an upstream laravel framework issue as how foreignId is handled?

The issue me and others keep coming across is:

• Change user ID in user migration to be UUID
• now sessions won't work unless you change:
  $table->foreignId('user_id')->nullable()->index(); to $table->uuid('user_id')->nullable()->index();

Now the question remains: is this change not how it should be proposed into the docs and should sessions be handled differently to accommodate for both numeric and string user IDs?

Also I'm not sure to which docs to submit this warning/notice to, since it automatically affects multiple regions:

• login/logout not working (due to csrf)
• all csrf tokens failing (mismatch)
• all forms failing (csrf mismatch)

Thanks!

[ctf0]

same here as well, i keep getting 419 | page expired unless VerifyCsrfToken mw is disabled

[Slayking]

Same here, this has been giving me a headache all day.

The CSRF token is always mismatched whilst using UUID's. It works fine if you use the File driver but that's not ideal.

[aibarra11]

thanks for bringing this up. all the other 419 fixes didn't work. For now, this is working for me.

[madalinignisca]

If you have a foreign id to an uuid, always the foreign id must be an uuid.

[sneakylenny]

I just ran into this issue and it noticed I forgot to add

protected $keyType = 'string';

to my User model. Which resulted in the session setting the first few digits of the uuid as user_id on the session.
After adding the keyType prop it worked and the full uuid was added to the session's user_id.

[pedrouzcategui]

Not sure if someone is still having this issue, but the workaround for me was to modify the "AuthenticatedSessionController.php" to manually set the user_id before the session is regenerated, this made it work.