Fix default session cookie name for non-alphanumeric APP_NAME

Since the switch to Str::snake() for the default session cookie name,
APP_NAME values containing characters like brackets or dots produced
cookie names with characters that browsers refuse to round-trip,
breaking session persistence and silently logging users out.

Wrap the result in Str::slug(..., '_') so the resolved cookie name is
always RFC 6265 safe while preserving the snake_case style for normal
APP_NAME values.

Author: vashukarn

config/session.php

@@ -129,7 +129,7 @@
 
     'cookie' => env(
         'SESSION_COOKIE',
-        Str::snake((string) env('APP_NAME', 'laravel')).'_session'
+        Str::slug(Str::snake((string) env('APP_NAME', 'laravel')), '_').'_session'
     ),
 
     /*

tests/Integration/Session/SessionCookieNameTest.php

@@ -0,0 +1,57 @@
+<?php
+
+namespace Illuminate\Tests\Integration\Session;
+
+use Illuminate\Support\Str;
+use PHPUnit\Framework\TestCase;
+
+class SessionCookieNameTest extends TestCase
+{
+    /**
+     * Resolve the default session cookie name the same way config/session.php does
+     * for a given APP_NAME value.
+     */
+    protected function resolveCookieName(string $appName): string
+    {
+        return Str::slug(Str::snake($appName), '_').'_session';
+    }
+
+    public function testSimpleAppNameProducesSnakeCasedCookie()
+    {
+        $this->assertSame('my_app_session', $this->resolveCookieName('My App'));
+        $this->assertSame('laravel_session', $this->resolveCookieName('laravel'));
+    }
+
+    public function testAppNameWithBracketsIsStrippedToSafeCharacters()
+    {
+        $this->assertSame(
+            'l_o_c_a_l_my_awesome_app_session',
+            $this->resolveCookieName('[LOCAL] My Awesome App'),
+        );
+    }
+
+    public function testAppNameWithDotIsStrippedToSafeCharacters()
+    {
+        $this->assertSame('admindomain_session', $this->resolveCookieName('admin.domain'));
+        $this->assertSame('examplecom_session', $this->resolveCookieName('example.com'));
+    }
+
+    public function testResolvedCookieNameOnlyContainsRfc6265SafeCharacters()
+    {
+        $names = [
+            '[LOCAL] My Awesome App',
+            'admin.domain',
+            'My App!',
+            'foo/bar',
+            'one;two',
+        ];
+
+        foreach ($names as $name) {
+            $this->assertMatchesRegularExpression(
+                '/^[A-Za-z0-9_]+$/',
+                $this->resolveCookieName($name),
+                "Cookie name for [$name] contained unsafe characters.",
+            );
+        }
+    }
+}