By default, Laravel allows requests using the same session to execute concurrently. So, for example, if you use a JavaScript HTTP library to make two HTTP requests to your application, they will both execute at the same time. For many applications, this is not a problem; however, session data loss can occur in a small subset of applications that make concurrent requests to two different application endpoints which both write data to the session.
To mitigate this, Laravel provides functionality that allows you to limit concurrent requests for a given session. To get started, you may simply chain the block
method onto your route definition. In this example, an incoming request to the /profile
endpoint would acquire a session lock. While this lock is being held, any incoming requests to the /profile
or /order
endpoints which share the same session ID will wait for the first request to finish executing before continuing their execution:
Route::post('/profile', function () {
//
})->block($lockSeconds = 10, $waitSeconds = 10)
Route::post('/order', function () {
//
})->block($lockSeconds = 10, $waitSeconds = 10)
The block
method accepts two optional arguments. The first argument accepted by the block
method is the maximum number of seconds the session lock should be held for before it is released. Of course, if the request finishes executing before this time the lock will be released earlier.
The second argument accepted by the block
method is the number of seconds a request should wait while attempting to obtain a session lock. A Illuminate\Contracts\Cache\LockTimeoutException
will be thrown if the request is unable to obtain a session lock within the given number of seconds.
If neither of these arguments are passed, the lock will be obtained for a maximum of 10 seconds and requests will wait a maximum of 10 seconds while attempting to obtain a lock:
Route::post('/profile', function () {
//
})->block()
For Example(1)
1.Add below lines in app\Http\kernel.php
protected $middleware = [
...
\App\Http\Middleware\ApiMiddleware::class,
\Illuminate\Session\Middleware\StartSession::class,
\Illuminate\View\Middleware\ShareErrorsFromSession::class,
\App\Http\Middleware\VerifyCsrfToken::class,
];
<?php
namespace App\Http\Middleware;
use Closure;
class ApiMiddleware
{
protected $except = [
'api/*'
];
/**
* Handle an incoming request.
*
* @param \Illuminate\Http\Request $request
* @param \Closure $next
* @return mixed
*/
public function handle($request, Closure $next)
{
foreach ($this->except as $except) {
if ($request->is($except)) {
config()->set('session.driver', 'array');
}
}
return $next($request);
}
}
<?php
namespace App\Http\Middleware;
use Closure;
use Illuminate\Foundation\Http\Middleware\VerifyCsrfToken as BaseVerifier;
class VerifyCsrfToken extends BaseVerifier
{
/**
* The URIs that should be excluded from CSRF verification.
*
* @var array
*/
protected $except = [
'api/*'
];
public function handle($request, Closure $next)
{
foreach ($this->except as $except) {
if ($request->is($except)) {
return $next($request);
}
}
return parent::handle($request, $next);
}
}
Route::post('formstore', 'demoController@formstore')->block($lockSeconds = 10, $waitSeconds = 10);