Lesson 9: Authentication — Sanctum & Fortify

Laravel: From Basics to Advanced

Part 3: Authentication & Authorization

xdev.asia

1. Laravel Sanctum

composer require laravel/sanctum
php artisan install:api

// User model
use Laravel\Sanctum\HasApiTokens;

class User extends Authenticatable
{
    use HasApiTokens;
}

// Login & issue token
public function login(Request $request)
{
    $credentials = $request->validate([
        'email' => 'required|email',
        'password' => 'required',
    ]);

    if (!Auth::attempt($credentials)) {
        throw ValidationException::withMessages([
            'email' => ['Thông tin đăng nhập không chính xác.'],
        ]);
    }

    $user = Auth::user();
    $token = $user->createToken('api', ['products:read', 'orders:write']);

    return response()->json([
        'token' => $token->plainTextToken,
        'user' => new UserResource($user),
    ]);
}

// Protect routes
Route::middleware('auth:sanctum')->group(function () {
    Route::apiResource('products', ProductController::class);
    Route::post('/logout', function (Request $request) {
        $request->user()->currentAccessToken()->delete();
        return response()->json(['message' => 'Logged out']);
    });
});

2. SPA Authentication

// config/sanctum.php
'stateful' => explode(',', env('SANCTUM_STATEFUL_DOMAINS', 'localhost:3000')),

// config/cors.php
'supports_credentials' => true,

3. Laravel Fortify (2FA)

use Laravel\Fortify\Fortify;

// FortifyServiceProvider
Fortify::loginView(fn () => view('auth.login'));
Fortify::registerView(fn () => view('auth.register'));

// Enable 2FA
'features' => [
    Features::registration(),
    Features::emailVerification(),
    Features::twoFactorAuthentication(['confirm' => true]),
],

4. Multi-Auth (Guards)

// config/auth.php
'guards' => [
    'web' => ['driver' => 'session', 'provider' => 'users'],
    'admin' => ['driver' => 'session', 'provider' => 'admins'],
],
'providers' => [
    'users' => ['driver' => 'eloquent', 'model' => User::class],
    'admins' => ['driver' => 'eloquent', 'model' => Admin::class],
],

// Route
Route::middleware('auth:admin')->prefix('admin')->group(function () {
    Route::get('/dashboard', [AdminController::class, 'dashboard']);
});

Next article: Authorization — Gates & Policies.