Merge pull request 'fix(auth): 補 StartSession middleware 給 OAuth routes' (#24) from security/auth-p2-lockout-oauth-state into master

Reviewed-on: #24
2026-06-02 17:47:57 +00:00
parent b06d8524db 3b90edf843
commit 981f753480
1 changed files with 5 additions and 3 deletions
@@ -30,9 +30,11 @@ Route::get('/diving-offers/{id}/reviews',  [ReviewController::class, 'publicList
 Route::post('/member/register', [AuthController::class, 'registerMember']);
 Route::middleware('throttle:10,1')->post('/member/login', [AuthController::class, 'loginMember']);

-// Google 第三方登入（僅會員）
-Route::get('/auth/google/redirect', [\App\Http\Controllers\API\SocialAuthController::class, 'redirectToGoogle']);
-Route::get('/auth/google/callback', [\App\Http\Controllers\API\SocialAuthController::class, 'handleGoogleCallback']);
+// Google 第三方登入（僅會員）— 需要 StartSession 支援 OAuth state
+Route::middleware([\Illuminate\Session\Middleware\StartSession::class])->group(function () {
+    Route::get('/auth/google/redirect', [\App\Http\Controllers\API\SocialAuthController::class, 'redirectToGoogle']);
+    Route::get('/auth/google/callback', [\App\Http\Controllers\API\SocialAuthController::class, 'handleGoogleCallback']);
+});

 // 會員專屬 API（需登入）
 Route::middleware(['auth:sanctum'])->prefix('member')->group(function () {