Lesson 11: OAuth2, Passport & Socialite

Laravel: From Basics to Advanced

Part 3: Authentication & Authorization

xdev.asia

1. Laravel Socialite

composer require laravel/socialite

// config/services.php
'google' => [
    'client_id' => env('GOOGLE_CLIENT_ID'),
    'client_secret' => env('GOOGLE_CLIENT_SECRET'),
    'redirect' => env('APP_URL') . '/auth/google/callback',
],

// Routes
Route::get('/auth/{provider}/redirect', [SocialAuthController::class, 'redirect']);
Route::get('/auth/{provider}/callback', [SocialAuthController::class, 'callback']);

// Controller
use Laravel\Socialite\Facades\Socialite;

class SocialAuthController extends Controller
{
    public function redirect(string $provider)
    {
        return Socialite::driver($provider)->redirect();
    }

    public function callback(string $provider)
    {
        $socialUser = Socialite::driver($provider)->user();

        $user = User::updateOrCreate(
            ['email' => $socialUser->getEmail()],
            [
                'name' => $socialUser->getName(),
                'provider' => $provider,
                'provider_id' => $socialUser->getId(),
                'avatar' => $socialUser->getAvatar(),
            ],
        );

        Auth::login($user, remember: true);
        return redirect('/dashboard');
    }
}

2. Laravel Passport

composer require laravel/passport
php artisan passport:install

// User model
use Laravel\Passport\HasApiTokens;

class User extends Authenticatable
{
    use HasApiTokens;
}

// config/auth.php
'guards' => [
    'api' => ['driver' => 'passport', 'provider' => 'users'],
],

// Scopes
Passport::tokensCan([
    'read-products' => 'Xem sản phẩm',
    'write-products' => 'Thêm/sửa sản phẩm',
    'manage-orders' => 'Quản lý đơn hàng',
]);

// Middleware
Route::middleware(['auth:api', 'scope:write-products'])->group(function () {
    Route::post('/products', [ProductController::class, 'store']);
});

3. Sanctum vs Passport

Features	Sanctum	Passport
SPA Auth	✅	✅
API Tokens	✅ (simple)	✅ (OAuth2 full)
OAuth2 Server	❌	✅
Third-party apps	❌	✅
Complexity	Low	High

Next article: Security Best Practices.