From 37ddbdc37f92f8e38deb080f7abb081fa473e347 Mon Sep 17 00:00:00 2001
From: peaklabs-dev <122374094+peaklabs-dev@users.noreply.github.com>
Date: Tue, 8 Sep 2026 12:14:29 +0200
Subject: [PATCH] fix(auth): redirect authenticated stale-token login
 submissions to the dashboard

---
 app/Exceptions/Handler.php                    |  7 ++++
 .../Auth/TwoFactorChallengeAccessTest.php     | 34 +++++++++++++++++++
 2 files changed, 41 insertions(+)

diff --git a/app/Exceptions/Handler.php b/app/Exceptions/Handler.php
index 4b4df4971..c3a52ea35 100644
--- a/app/Exceptions/Handler.php
+++ b/app/Exceptions/Handler.php
@@ -4,9 +4,11 @@
 
 use App\Models\InstanceSettings;
 use App\Models\User;
+use App\Providers\RouteServiceProvider;
 use Illuminate\Auth\Access\AuthorizationException;
 use Illuminate\Auth\AuthenticationException;
 use Illuminate\Foundation\Exceptions\Handler as ExceptionHandler;
+use Illuminate\Session\TokenMismatchException;
 use Psr\Log\LogLevel;
 use RuntimeException;
 use Sentry\Laravel\Integration;
@@ -69,6 +71,11 @@ protected function unauthenticated($request, AuthenticationException $exception)
      */
     public function render($request, Throwable $e)
     {
+        // A duplicate login or 2FA submission carries a stale token on an already authenticated session, see https://github.com/coollabsio/coolify/issues/10670
+        if ($e instanceof TokenMismatchException && $request->routeIs('login.store', 'two-factor.login.store') && $request->user()) {
+            return redirect()->intended(RouteServiceProvider::HOME);
+        }
+
         // Handle authorization exceptions for API routes. Exceptions carrying
         // an explicit status (e.g. denyAsNotFound) keep it via parent::render.
         if ($e instanceof AuthorizationException && ! $e->hasStatus()) {
diff --git a/tests/Feature/Auth/TwoFactorChallengeAccessTest.php b/tests/Feature/Auth/TwoFactorChallengeAccessTest.php
index f0dd97cc3..a46f6b35c 100644
--- a/tests/Feature/Auth/TwoFactorChallengeAccessTest.php
+++ b/tests/Feature/Auth/TwoFactorChallengeAccessTest.php
@@ -3,7 +3,11 @@
 use App\Models\InstanceSettings;
 use App\Models\Team;
 use App\Models\User;
+use Illuminate\Contracts\Debug\ExceptionHandler;
 use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Http\Request;
+use Illuminate\Session\TokenMismatchException;
+use Illuminate\Support\Facades\Route;
 
 uses(RefreshDatabase::class);
 
@@ -78,3 +82,33 @@
     expect($view)->toContain('error-shell');
     expect($view)->not->toContain('url()->previous()');
 });
+
+it('redirects an authenticated stale two-factor submission home instead of showing 419', function () {
+    $request = Request::create('/two-factor-challenge', 'POST');
+    $request->setRouteResolver(fn () => Route::getRoutes()->match($request));
+    $request->setUserResolver(fn () => $this->user);
+
+    $response = app(ExceptionHandler::class)->render($request, new TokenMismatchException('CSRF token mismatch.'));
+
+    expect($response->getStatusCode())->toBe(302)
+        ->and($response->headers->get('Location'))->toBe(url('/'));
+});
+
+it('still returns 419 for a stale two-factor submission without an authenticated session', function () {
+    $request = Request::create('/two-factor-challenge', 'POST');
+    $request->setRouteResolver(fn () => Route::getRoutes()->match($request));
+
+    $response = app(ExceptionHandler::class)->render($request, new TokenMismatchException('CSRF token mismatch.'));
+
+    expect($response->getStatusCode())->toBe(419);
+});
+
+it('keeps the 419 for stale tokens on routes other than login and the two-factor challenge', function () {
+    $request = Request::create('/two-factor-challenge', 'GET');
+    $request->setRouteResolver(fn () => Route::getRoutes()->match($request));
+    $request->setUserResolver(fn () => $this->user);
+
+    $response = app(ExceptionHandler::class)->render($request, new TokenMismatchException('CSRF token mismatch.'));
+
+    expect($response->getStatusCode())->toBe(419);
+});