People searching “Laravel Vue profile settings” scaffold a second profile. The Vue starter kit already has resources/js/pages/settings/Profile.vue and a controller that updates the signed-in user. The Fortify guide is the auth around it. This page is the save.
TL;DR
- Update the signed-in user from the kit’s profile page.
- Ignore their id on the unique email rule.
- Do not accept
id,is_admin, oremail_verified_atfrom the request. - Do not add a users admin screen on this change.
The fix#
$validated = $request->validate([
'name' => ['required', 'string', 'max:255'],
'email' => [
'required',
'email',
'max:255',
Rule::unique('users', 'email')->ignore($request->user()->id),
],
]);
$user = $request->user();
$user->fill($validated);
if ($user->isDirty('email')) {
$user->email_verified_at = null;
}
$user->save();Clearing email_verified_at forces the verification mail again. Skip that line and a user can switch the address to one they do not own and stay “verified”.
The form posts the name and the email and reads form.errors.email. Do not accept id, is_admin, or email_verified_at from the request. Do not add a users admin screen on this change. One person edits their own row.
FAQ#
How do I update a profile from a Vue settings page?
Update the signed-in user from the kit's profile page. Ignore their id on the unique email rule.
What goes wrong with Laravel Vue profile settings?
Many developers scaffold a second profile. Do not accept id, is_admin, or email_verified_at from the request.
