For the authenticated user to be populated you must inform AdonisJS to check for it. This saves the roundtrip to populate the user in cases where it isn't needed.

To populate the user, you have two options

1. authenticate - Requires an authenticated user. If an authenticated user is not found, an exception is thrown.

2. check - Will check to see if a user is authenticated, and populate that user if so. The request goes on as usual if an authenticated user is not found.

In terms of middleware, you have three options

1. auth - Will call authenticate and redirect the user to the login page by default if an authenticated user is not found.

2. guest - Will call check and redirect the user, I believe to the home page, by default if an authenticated user is found.

3. silent_auth - Will call check and progress with the request as usual.

So, you're most likely getting "the page isn't redirecting properly" because your authenticate on the login page is attempting to redirect the user to the login page, resulting in an infinite redirect loop.

You most likely will want to replace your authenticate on the login page with the guest middleware and that should fix the redirect loop. Then, for internal pages, you can either use authenticate if the user must be authenticated to access the page, check if the user may or may not be authenticated to access the page, or one of the corresponding middleware.

Hi Arron!

Great question, I now wish I would've injected this into the lesson; I think I'll make a note to do that.

The Referrer-Policy mentioned is a response header. So, in the controller rendering this page you'd add it using the HttpContext's response, like below. This is a step recommended by OWASP.

async reset({ params, inertia, response }: HttpContext) {
  const { isValid, user } = await VerifyPasswordResetToken.handle({ 
    encryptedHash: params.hash 
  })

  response.header('Referrer-Policy', 'no-referrer') // 👈

  return inertia.render('auth/forgot_password/reset', {
    hash: params.hash,
    email: user?.email,
    isValid,
  })
}

  

    

      Copied!