Laravel Legacy Bridge: Migrate Sessions Seamlessly | Mohamed Said [Skip to content](#main) [ ![](https://cdn.msaied.com/01KT78WE565VEMM3PSNQAAB0MH.png) Mohamed SaidLaravel Backend Engineer ](https://www.msaied.com/public) - [Home](https://www.msaied.com/public) - [Projects](https://www.msaied.com/public/projects) - [Articles](https://www.msaied.com/public/articles) - [Certificates](https://www.msaied.com/public/certificates) - [About](https://www.msaied.com/public#about) [ Contact](https://www.msaied.com/public#contact) Menu Menu ---- Close - [HomeStart here](https://www.msaied.com/public) - [ProjectsCase studies](https://www.msaied.com/public/projects) - [ArticlesEngineering notes](https://www.msaied.com/public/articles) - [CertificatesCredentials](https://www.msaied.com/public/certificates) - [AboutHow I work](https://www.msaied.com/public#about) - [ContactGet in touch](https://www.msaied.com/public#contact) [Start a conversation](https://www.msaied.com/public#contact) [WhatsApp](https://wa.me/201094619204) [Email](mailto:hello@msaied.com) 1. [Home](https://www.msaied.com/public) 2. / 3. [Articles](https://www.msaied.com/public/articles) 4. / 5. [Laravel](https://www.msaied.com/public/articles?category=laravel) 6. / 7. Laravel Legacy Bridge: Carry Authenticated Sessions from a Legacy PHP App into Laravel [Laravel](https://www.msaied.com/public/articles?category=laravel) [Composer Pacakge](https://www.msaied.com/public/articles?category=composer-pacakge) Laravel Legacy Bridge: Carry Authenticated Sessions from a Legacy PHP App into Laravel ======================================================================================= Laravel Legacy Bridge is a package that reads a legacy session cookie, decodes the payload from the legacy database, and authenticates the matching user in Laravel — no double login required during incremental migrations. ![](https://cdn.msaied.com/01M22N44A70A5MC2S599JP0MPH.webp) [Mohamed Said](https://www.msaied.com/public#person) Published 15 Jul 2026 · Updated 15 Jul 2026 · 4 min read ShareCopy linkCopied ![Laravel Legacy Bridge: Carry Authenticated Sessions from a Legacy PHP App into Laravel](https://cdn.msaied.com/429/5abced4ee695d6c03e3ae41bbf2fe4bb.png) On this page +1. [The Problem: Two Apps, One User, Zero Shared Sessions](#the-problem-two-apps-one-user-zero-shared-sessions) 2. [How the Bridge Works](#how-the-bridge-works) 3. [Resolvers and Payload Formats](#resolvers-and-payload-formats) 4. [Events Instead of Log Noise](#events-instead-of-log-noise) 5. [Installation and the Verify Command](#installation-and-the-verify-command) 6. [Security Considerations](#security-considerations) 7. [Key Takeaways](#key-takeaways) The Problem: Two Apps, One User, Zero Shared Sessions ----------------------------------------------------- Incremental migrations to Laravel are practical, but they create an awkward authentication gap. A user logs in on the old CodeIgniter or custom PHP side, follows a link to a Laravel-handled route, and Laravel — knowing nothing about that session — redirects them to a login form. [Laravel Legacy Bridge](https://github.com/chr15k/laravel-legacy-bridge), a package by Chris Keller, closes that gap without requiring users to authenticate twice. The package reads the legacy session cookie on unauthenticated requests, decodes the session payload from the legacy database, resolves a user ID, and calls `loginUsingId()`. Laravel then writes its own session, and every subsequent request bypasses the legacy store entirely. How the Bridge Works -------------------- Registering one middleware is all it takes to put the bridge in the request path: ```php ->withMiddleware(function (Middleware $middleware) { $middleware->web(append: [ \Chr15k\LegacyBridge\Http\Middleware\LegacySessionBridge::class, ]); }) ``` The middleware only runs on unauthenticated requests. Once Laravel has established its own session, the legacy store is never consulted again. The service provider also automatically excludes the legacy cookie from Laravel's `EncryptCookies` middleware, so there is no list to maintain manually. Resolvers and Payload Formats ----------------------------- Legacy apps store the user ID under wildly different keys. The package handles this through configurable resolver drivers in `config/legacy-bridge.php`: ```php // Auto-detection (default) 'resolver' => ['driver' => 'auto'], // Explicit dot-notation key 'resolver' => ['driver' => 'key', 'key' => 'user_id'], // Custom class for complex mappings 'resolver' => ['driver' => 'custom', 'class' => \App\Bridge\LegacyUserResolver::class], ``` The README recommends starting with `auto` and switching to `key` or `custom` before going to production. A custom resolver is also the right place to map old user IDs to new ones if your migration re-seeded the users table. Payload format is a separate setting that accepts `auto`, `php_session`, `json`, `laravel`, or `encrypted`. The `encrypted` format reads the legacy app's key from `LEGACY_BRIDGE_APP_KEY`. Events Instead of Log Noise --------------------------- The bridge writes nothing to your log files. Instead it dispatches three typed events: - **`LegacySessionBridged`** — successful authentication - **`LegacySessionBridgeFailed`** — known failure with a `BridgeFailureReason` enum (eight cases including `MissingCookie`, `SessionExpired`, and `UserNotResolved`) - **`LegacySessionBridgeError`** — unexpected exception Failure events carry a `BridgeContext` DTO with everything the bridge resolved before stopping: cookie name, session ID, decoded payload, resolved user ID, and basic request context (IP, path, method, user agent). Installation and the Verify Command ----------------------------------- ```bash composer require chr15k/laravel-legacy-bridge php artisan legacy-bridge:install ``` The interactive install command includes presets for common legacy frameworks, collects database credentials, and writes the required `.env` entries. Before real traffic hits the bridge, run the verify command against your actual legacy database: ```bash php artisan legacy-bridge:verify php artisan legacy-bridge:verify --session-id=a_real_session_id ``` Without a session ID it checks configuration, database connectivity, table existence, resolver setup, and cookie name collisions. With a real session ID it reports exactly what the bridge would do: format detected, payload keys found, user ID resolved, user confirmed to exist. It authenticates no one and modifies nothing. Security Considerations ----------------------- Read the security section of the README before deploying. Key points: - The bridge deserializes payloads directly from the legacy sessions table — use read-only database credentials where possible. - The legacy cookie travels unencrypted by design; both applications must be served over HTTPS. - The default `after_write` invalidation strategy deletes the legacy session once Laravel writes its own. Setting invalidation to `never` in production is explicitly discouraged. - The first release supports **database sessions only** (not file, Redis, or Memcached), web requests only, and the default auth guard only. - Requires **Laravel 13** and **PHP 8.3** or newer. Key Takeaways ------------- - One middleware registration bridges authenticated sessions from any legacy PHP app into Laravel. - Supports PHP session encoding, JSON, Laravel's serialized format, and encrypted payloads. - Three resolver drivers handle simple to complex user ID lookups, including ID remapping. - Typed events give you full observability without polluting log files. - The `legacy-bridge:verify` command lets you test the full pipeline against real data before deployment. - Legacy sessions are invalidated after a successful bridge by default, preventing replay. --- *Source: [Laravel Legacy Bridge on Laravel News](https://laravel-news.com/laravel-legacy-bridge-carry-authenticated-sessions-from-a-legacy-app-into-laravel)* - [Laravel](https://www.msaied.com/public/articles?search=Laravel) - [PHP](https://www.msaied.com/public/articles?search=PHP) - [Session Management](https://www.msaied.com/public/articles?search=Session%20Management) - [Migration](https://www.msaied.com/public/articles?search=Migration) - [Laravel Packages](https://www.msaied.com/public/articles?search=Laravel%20Packages) Frequently asked questions --------------------------- Does Laravel Legacy Bridge work with Redis or file-based legacy sessions?No. The first release supports database-backed sessions only. File, Redis, and Memcached session drivers are not supported yet. How do I handle legacy apps that store user IDs under a non-standard key?Set the resolver driver to 'key' with a dot-notation path, or implement a custom resolver class. A custom resolver also lets you remap old user IDs to new ones if your migration re-seeded the users table. Is it safe to deserialize payloads from the legacy sessions table?The legacy sessions table becomes a trust boundary because payloads are deserialized directly. The package author recommends using read-only database credentials for the legacy connection and ensuring both applications are served over HTTPS. ![Mohamed Said](https://cdn.msaied.com/01M22N44A70A5MC2S599JP0MPH.webp)About the author ---------------- [Mohamed Said](https://www.msaied.com/public#person)Senior Backend Engineer specializing in Laravel, scalable SaaS platforms, APIs, and cloud infrastructure. I build secure, high-performance web applications that help businesses grow. [About](https://www.msaied.com/public#about) [GitHub ↗](https://github.com/EG-Mohamed) [LinkedIn ↗](https://www.linkedin.com/in/msaiedm/) [WhatsApp ↗](https://wa.me/201094619204) [Email Address ↗](mailto:hello@msaied.com) [My CV ↗](https://drive.google.com/file/u/0/d/1MF20IPRJyzfy32mhEutjL5EpSls0w2Q8/view) [Previous articleFirst-Party Image Processing in Laravel 13.20](https://www.msaied.com/public/articles/first-party-image-processing-in-laravel-1320) [Next articleFilament v4 Testing with Pest: Resources, Actions, and Form Assertions](https://www.msaied.com/public/articles/filament-v4-testing-with-pest-resources-actions-and-form-assertions) On this page ------------- 1. [The Problem: Two Apps, One User, Zero Shared Sessions](#the-problem-two-apps-one-user-zero-shared-sessions) 2. [How the Bridge Works](#how-the-bridge-works) 3. [Resolvers and Payload Formats](#resolvers-and-payload-formats) 4. [Events Instead of Log Noise](#events-instead-of-log-noise) 5. [Installation and the Verify Command](#installation-and-the-verify-command) 6. [Security Considerations](#security-considerations) 7. [Key Takeaways](#key-takeaways) ### Have a technical challenge? Tell me what you’re building. I reply within two working days. [Start a conversation](https://www.msaied.com/public#contact) Related articles ----------------- [ ![](https://cdn.msaied.com/740/cce86edc21eddcbdd2f2454fadaf9c70.png) · 3 min read### The Pipeline Pattern in Laravel: Custom Pipelines Beyond Middleware 5 Oct 2026 ](https://www.msaied.com/public/articles/the-pipeline-pattern-in-laravel-custom-pipelines-beyond-middleware-1) [ ![](https://cdn.msaied.com/739/2d6897fdcdcf090613f96f72a64b8a78.png) · 4 min read### MySQL Full-Text Search in Laravel: Indexes, Relevance Scoring, and Boolean Mode 4 Oct 2026 ](https://www.msaied.com/public/articles/mysql-full-text-search-in-laravel-indexes-relevance-scoring-and-boolean-mode) [ ![](https://cdn.msaied.com/738/073696a3fefe18bec825beec5ac658f5.png) · 4 min read### Laravel Queue Rate-Limited Middleware: Throttling Jobs Without Losing Work 4 Oct 2026 ](https://www.msaied.com/public/articles/laravel-queue-rate-limited-middleware-throttling-jobs-without-losing-work) Have a technical challenge? ---------------------------- Tell me what you’re building. I reply within two working days. [Discuss your project ↗](https://www.msaied.com/public#contact) © 2026 Mohamed Said · Built with Laravel, meant to last.Senior Backend Engineer specializing in Laravel, scalable SaaS platforms, APIs, and cloud infrastructure. I build secure, high-performance web applications that help businesses grow. - [Home](https://www.msaied.com/public) - [Articles](https://www.msaied.com/public/articles) - [Certificates](https://www.msaied.com/public/certificates) - [GitHub](https://github.com/EG-Mohamed) - [LinkedIn](https://www.linkedin.com/in/msaiedm/) - [WhatsApp](https://wa.me/201094619204) - [Email Address](mailto:hello@msaied.com) - [My CV](https://drive.google.com/file/u/0/d/1MF20IPRJyzfy32mhEutjL5EpSls0w2Q8/view) - [Sitemap](https://www.msaied.com/public/sitemap.xml)