第 9 課：身份驗證 — Sanctum 和 Fortify

Laravel：從基礎到高級

第 3 部分：身份驗證和授權

亞洲開發網

1. Laravel 聖所

composer require laravel/sanctum
php artisan install:api

// User model
use Laravel\Sanctum\HasApiTokens;

class User extends Authenticatable
{
    use HasApiTokens;
}

// Login & issue token
public function login(Request $request)
{
    $credentials = $request->validate([
        'email' => 'required|email',
        'password' => 'required',
    ]);

    if (!Auth::attempt($credentials)) {
        throw ValidationException::withMessages([
            'email' => ['Thông tin đăng nhập không chính xác.'],
        ]);
    }

    $user = Auth::user();
    $token = $user->createToken('api', ['products:read', 'orders:write']);

    return response()->json([
        'token' => $token->plainTextToken,
        'user' => new UserResource($user),
    ]);
}

// Protect routes
Route::middleware('auth:sanctum')->group(function () {
    Route::apiResource('products', ProductController::class);
    Route::post('/logout', function (Request $request) {
        $request->user()->currentAccessToken()->delete();
        return response()->json(['message' => 'Logged out']);
    });
});

2.SPA認證

// config/sanctum.php
'stateful' => explode(',', env('SANCTUM_STATEFUL_DOMAINS', 'localhost:3000')),

// config/cors.php
'supports_credentials' => true,

3.Laravel Fortify（2FA）

use Laravel\Fortify\Fortify;

// FortifyServiceProvider
Fortify::loginView(fn () => view('auth.login'));
Fortify::registerView(fn () => view('auth.register'));

// Enable 2FA
'features' => [
    Features::registration(),
    Features::emailVerification(),
    Features::twoFactorAuthentication(['confirm' => true]),
],

4. 多重身分驗證（守衛）

// config/auth.php
'guards' => [
    'web' => ['driver' => 'session', 'provider' => 'users'],
    'admin' => ['driver' => 'session', 'provider' => 'admins'],
],
'providers' => [
    'users' => ['driver' => 'eloquent', 'model' => User::class],
    'admins' => ['driver' => 'eloquent', 'model' => Admin::class],
],

// Route
Route::middleware('auth:admin')->prefix('admin')->group(function () {
    Route::get('/dashboard', [AdminController::class, 'dashboard']);
});

下一篇： 授權－門禁與政策。