Merge pull request 'fix(auth): 補 StartSession middleware 給 OAuth routes' (#24 ) from security/auth-p2-lockout-oauth-state into master

Reviewed-on: #24
fix(auth): 補 StartSession middleware 給 OAuth routes
2026-06-02 17:47:57 +00:00 · 2026-06-03 01:44:29 +08:00
1 changed files with 5 additions and 3 deletions
@@ -30,9 +30,11 @@ Route::get('/diving-offers/{id}/reviews',  [ReviewController::class, 'publicList
 Route::post('/member/register', [AuthController::class, 'registerMember']);
 Route::middleware('throttle:10,1')->post('/member/login', [AuthController::class, 'loginMember']);

-// Google 第三方登入（僅會員）
-Route::get('/auth/google/redirect', [\App\Http\Controllers\API\SocialAuthController::class, 'redirectToGoogle']);
-Route::get('/auth/google/callback', [\App\Http\Controllers\API\SocialAuthController::class, 'handleGoogleCallback']);
+// Google 第三方登入（僅會員）— 需要 StartSession 支援 OAuth state
+Route::middleware([\Illuminate\Session\Middleware\StartSession::class])->group(function () {
+    Route::get('/auth/google/redirect', [\App\Http\Controllers\API\SocialAuthController::class, 'redirectToGoogle']);
+    Route::get('/auth/google/callback', [\App\Http\Controllers\API\SocialAuthController::class, 'handleGoogleCallback']);
+});

 // 會員專屬 API（需登入）
 Route::middleware(['auth:sanctum'])->prefix('member')->group(function () {
Author	SHA1	Message	Date
a620906209	981f753480	Merge pull request 'fix(auth): 補 StartSession middleware 給 OAuth routes' (#24 ) from security/auth-p2-lockout-oauth-state into master Deploy Production / deploy (push) Successful in 12s Details Reviewed-on: #24	2026-06-02 17:47:57 +00:00
a620906209	3b90edf843	fix(auth): 補 StartSession middleware 給 OAuth routes api.php 的 route 預設無 session middleware，移除 stateless() 後 session() 呼叫直接 500。只對 /auth/google/* 兩個 route 加 StartSession，不影響其他 API endpoint。 Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-06-03 01:44:29 +08:00