# LendCore Web Login and Session Fix Documentation

## Overview
This document describes the fix implemented for web login and session handling in the LendCore Laravel application. The changes were made to ensure:

- Laravel web login works correctly for both user and admin roles.
- Session cookies are created and preserved across requests.
- `Page Expired` and `404` issues caused by session / route configuration are addressed.
- API operations remain unchanged and continue to work normally.
- The application is ready for both local development and secure production environments.

## Root Cause Analysis
The problem was caused by a combination of:

- `SESSION_SECURE_COOKIE=true` while running the web app locally over HTTP, which prevented cookies from being sent.
- `SESSION_DOMAIN` configured in `.env` for ngrok only, which is fragile and can break cookie scope for local browser sessions.
- Duplicate logout route definitions in `routes/web.php`, increasing the chance of route collisions.
- An admin login handler with no session regeneration or route naming consistency.

## Files Updated

- `.env`
- `config/session.php`
- `routes/web.php`
- `resources/views/admin/auth/login.blade.php`

## Changes Made

### `.env`

- Cleared `SESSION_DOMAIN` so Laravel uses the default cookie domain behavior.
- Set `SESSION_SECURE_COOKIE=false` for local HTTP development.
- Set `SESSION_SAME_SITE=lax` for reliable local form-based login and CSRF handling.
- Added local development domains to `SANCTUM_STATEFUL_DOMAINS`:
  - `localhost`
  - `127.0.0.1`
  - `::1`
  - `localhost:8000`
  - `127.0.0.1:8000`
  - `flawed-exactly-jerrell.ngrok-free.dev`

> Note: For production or HTTPS/ngrok deployments, set `SESSION_SECURE_COOKIE=true`, `SESSION_SAME_SITE=none`, and configure `SESSION_DOMAIN` to the appropriate domain.

### `config/session.php`

- Set `'domain' => env('SESSION_DOMAIN') ?: null` so an empty domain value does not become a literal invalid string.
- Set `'secure' => env('SESSION_SECURE_COOKIE', env('APP_ENV') === 'production')`.
- Set `'same_site' => env('SESSION_SAME_SITE', env('APP_ENV') === 'production' ? 'none' : 'lax')`.

These defaults ensure local development works while enabling secure cookie behavior automatically in production.

### `routes/web.php`

- Removed duplicate `POST /logout` route.
- Added a named admin login route `admin.login.submit`.
- Added validation and session regeneration for admin login.
- Improved admin login failure handling with error messages.

### `resources/views/admin/auth/login.blade.php`

- Switched the admin login form to use `route('admin.login.submit')` instead of a hard-coded `/admin/login` URL.

## Why These Fixes Work

- `SESSION_SECURE_COOKIE=false` allows browsers to send cookies over HTTP during local testing.
- `SESSION_DOMAIN=` avoids domain-scoped cookie problems when using localhost or ngrok.
- `SESSION_SAME_SITE=lax` allows normal form submission from the same site while still protecting against cross-site requests.
- Explicit route naming and session regeneration ensure the admin login flow is stable and secure.
- API behavior remains untouched, so mobile app endpoints continue operating normally.

## Deployment Notes

For production deployment, update the environment variables as follows:

- `APP_ENV=production`
- `APP_URL=https://your-production-domain`
- `SESSION_DOMAIN=your-production-domain`
- `SESSION_SECURE_COOKIE=true`
- `SESSION_SAME_SITE=none`
- `SANCTUM_STATEFUL_DOMAINS=your-production-domain`

## Validation

After the fix, the configuration files pass syntax checks:

- `php -l config/session.php`
- `php -l routes/web.php`

These checks confirm the edited files are syntactically valid.
