Regenerate the session after a successful manual login
A custom login screen checks credentials successfully, but the implementation stops immediately after authentication. A successful login should also rotate the session identifier so the authenticated session does not continue under an identifier established before login.
Follow the framework login flow
if (Auth::attempt($credentials)) {
$request->session()->regenerate();
return redirect()->intended('/dashboard');
}
This is the success branch of a conventional session-based login. It omits credential validation, throttling, and failure handling. Prefer the framework's maintained authentication starter flow when possible rather than rebuilding those pieces from this fragment.
Logout has its own cleanup
A complete logout invalidates the session and regenerates the CSRF token according to Laravel's documented pattern. Removing a frontend cookie label or redirecting to the login screen is not equivalent to ending the server-side authenticated session.
Use secure cookie settings appropriate to HTTPS production and verify proxy configuration if TLS terminates upstream. A session problem can be caused by the wrong domain or scheme configuration even when the controller is correct.
Test login success, login failure, protected-route access afterward, and access after logout. Preserve throttling tests so a custom design does not accidentally remove the rate limit. Do not log submitted credentials while debugging session behavior. The session identifier and authentication result are sensitive enough to require careful diagnostics even when no password is printed.