--- title: Laravel Legacy Bridge: Carry Authenticated Sessions from... description: Laravel Legacy Bridge is a PHP package that solves the double-login problem when incrementally migrating a legacy PHP app (e.g., CodeIgniter) to Laravel. It... canonical: https://daily.dev/posts/laravel-legacy-bridge-carry-authenticated-sessions-from-a-legacy-app-into-laravel-8dhsgyhoe twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Laravel Legacy Bridge: Carry Authenticated Sessions from a Legacy App into Laravel | daily.dev og:description: Laravel Legacy Bridge is a PHP package that solves the double-login problem when incrementally migrating a legacy PHP app (e.g., CodeIgniter) to Laravel. It... og:url: https://daily.dev/posts/laravel-legacy-bridge-carry-authenticated-sessions-from-a-legacy-app-into-laravel-8dhsgyhoe og:image: https://api.daily.dev/og/posts/8dHsgYhOE.png og:image:alt: Laravel Legacy Bridge: Carry Authenticated Sessions from a Legacy App into Laravel og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Laravel Legacy Bridge: Carry Authenticated Sessions from a Legacy App into Laravel **[Laravel News](https://daily.dev/sources/ln)** · 5 min read · 14 upvotes · 0 comments ## Summary Laravel Legacy Bridge is a PHP package that solves the double-login problem when incrementally migrating a legacy PHP app (e.g., CodeIgniter) to Laravel. It works by reading the legacy PHPSESSID cookie on unauthenticated requests, decoding the session payload from the legacy database, and calling loginUsingId() to authenticate the user in Laravel — so users never see a second login prompt mid-migration. Key features include support for multiple payload formats (native PHP, JSON, Laravel serialized, encrypted), configurable resolver drivers (auto, key-based, or custom class), typed events for success/failure with no built-in logging, one-time session invalidation after bridging, an interactive install command with framework presets, and a verify command to test configuration against a real legacy database before going live. Security considerations include treating the legacy sessions table as a trust boundary, requiring HTTPS on both apps, and using read-only database credentials. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How can I keep users logged in when migrating a legacy PHP app to Laravel one route at a time? A middleware package called Laravel Legacy Bridge reads the legacy session cookie on unauthenticated requests, decodes the payload from the legacy sessions database, resolves the user ID, and calls loginUsingId() so Laravel authenticates the same user without a second login form. It supports native PHP, JSON, Laravel serialize, and encrypted payload formats, and requires Laravel 13 with PHP 8.3 or newer. _daily.dev surfaces practical packages like this for teams handling incremental Laravel migrations._ ### What session storage drivers does Laravel Legacy Bridge support in its first release? The first release only supports database sessions, not file, Redis, or Memcached session drivers. It bridges standard web requests into the default auth guard only, not stateless API requests, so teams using other session drivers or API-based auth would need to wait for later releases or adapt their setup. _Developers weighing migration tooling limitations can track packages like this via daily.dev._ ### Is it safe to read a legacy session cookie in plaintext when migrating to Laravel? The legacy cookie travels unencrypted by design, matching how it behaved on the old application, so both the legacy app and the new Laravel app need HTTPS to stay safe. The legacy sessions database becomes a trust boundary since payloads are deserialized directly from it, and read-only database credentials are recommended where possible. _Security-conscious Laravel developers can follow migration security guidance like this through daily.dev._ ## Similar posts on daily.dev - [Laravel Introduces First-Party Passkey Authentication Support](https://daily.dev/posts/laravel-introduces-first-party-passkey-authentication-support-cztccowtr) · Laravel News · 18 upvotes · 2 comments - [Elastic Bridge: Eloquent-Style Queries for Elasticsearch and OpenSearch](https://daily.dev/posts/elastic-bridge-eloquent-style-queries-for-elasticsearch-and-opensearch-bkajh2sah) · Laravel News · 0 upvotes · 0 comments - [Laravel - The clean stack for Artisans and agents](https://daily.dev/posts/laravel---the-clean-stack-for-artisans-and-agents-c3cowgih4) · Laravel · 12 upvotes · 0 comments --- Tags: [#php](https://daily.dev/tags/php), [#authentication](https://daily.dev/tags/authentication), [#laravel](https://daily.dev/tags/laravel) [View this post on daily.dev](https://daily.dev/posts/laravel-legacy-bridge-carry-authenticated-sessions-from-a-legacy-app-into-laravel-8dhsgyhoe) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Laravel Legacy Bridge: Carry Authenticated Sessions from a Legacy App into Laravel","url":"https://daily.dev/posts/laravel-legacy-bridge-carry-authenticated-sessions-from-a-legacy-app-into-laravel-8dhsgyhoe","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/laravel-legacy-bridge-carry-authenticated-sessions-from-a-legacy-app-into-laravel-8dhsgyhoe"},"datePublished":"2026-07-15T13:48:22.335Z","dateModified":"2026-09-14T06:00:51.538Z","description":"Laravel Legacy Bridge is a PHP package that solves the double-login problem when incrementally migrating a legacy PHP app (e.g., CodeIgniter) to Laravel. It...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/0c16515c4367718c04fc322c75e267b7?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/0c16515c4367718c04fc322c75e267b7?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Laravel News","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Laravel News","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/ln","url":"https://daily.dev/sources/ln"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/laravel-legacy-bridge-carry-authenticated-sessions-from-a-legacy-app-into-laravel-8dhsgyhoe","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":14},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"php,authentication,laravel","timeRequired":"PT5M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Laravel News","item":"https://daily.dev/sources/ln"},{"@type":"ListItem","position":3,"name":"Laravel Legacy Bridge: Carry Authenticated Sessions from a Legacy App into Laravel"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/laravel-legacy-bridge-carry-authenticated-sessions-from-a-legacy-app-into-laravel-8dhsgyhoe#faq","mainEntity":[{"@type":"Question","name":"How can I keep users logged in when migrating a legacy PHP app to Laravel one route at a time?","acceptedAnswer":{"@type":"Answer","text":"A middleware package called Laravel Legacy Bridge reads the legacy session cookie on unauthenticated requests, decodes the payload from the legacy sessions database, resolves the user ID, and calls loginUsingId() so Laravel authenticates the same user without a second login form. It supports native PHP, JSON, Laravel serialize, and encrypted payload formats, and requires Laravel 13 with PHP 8.3 or newer. daily.dev surfaces practical packages like this for teams handling incremental Laravel migrations."}},{"@type":"Question","name":"What session storage drivers does Laravel Legacy Bridge support in its first release?","acceptedAnswer":{"@type":"Answer","text":"The first release only supports database sessions, not file, Redis, or Memcached session drivers. It bridges standard web requests into the default auth guard only, not stateless API requests, so teams using other session drivers or API-based auth would need to wait for later releases or adapt their setup. Developers weighing migration tooling limitations can track packages like this via daily.dev."}},{"@type":"Question","name":"Is it safe to read a legacy session cookie in plaintext when migrating to Laravel?","acceptedAnswer":{"@type":"Answer","text":"The legacy cookie travels unencrypted by design, matching how it behaved on the old application, so both the legacy app and the new Laravel app need HTTPS to stay safe. The legacy sessions database becomes a trust boundary since payloads are deserialized directly from it, and read-only database credentials are recommended where possible. Security-conscious Laravel developers can follow migration security guidance like this through daily.dev."}}]} ```