Added password hash to session for enhanced security

classes/SessionGuard.php

@@ -83,6 +83,8 @@ public function loginQuietly(Authenticatable $user)
     {
         $this->updatePersistSession($user);
 
+        $this->updatePasswordHashSession($user);
+
         $this->updateSession($user->getAuthIdentifier());
 
         $this->setUser($user);
@@ -130,6 +132,8 @@ protected function clearUserDataFromStorage()
     {
         $this->session->remove($this->getPersistCodeName());
 
+        $this->session->remove($this->getPasswordHashName());
+
         parent::clearUserDataFromStorage();
     }
 
@@ -148,4 +152,5 @@ public function getRecallerName()
     {
         return 'user_auth';
     }
+
 }

classes/sessionguard/HasPersistence.php

@@ -49,6 +49,14 @@ protected function updatePersistSession(User $user)
         return $this->session->put($this->getPersistCodeName(), $user->getPersistCode());
     }
 
+    /**
+     * updatePasswordHashSession
+     */
+    protected function updatePasswordHashSession(User $user)
+    {
+        return $this->session->put($this->getPasswordHashName(), $user->getAuthPassword());
+    }
+
     /**
      * hasValidPersistCode
      */
@@ -64,4 +72,12 @@ public function getPersistCodeName()
     {
         return 'user_persist_code';
     }
+
+    /**
+     * getPasswordHashName gets the name of the session used to store the password
+     */
+    public function getPasswordHashName()
+    {
+        return 'password_hash_' . $this->name;
+    }
 }