Authentifizierung mit Laravel Sanctum

Was ist Sanctum?

Sanctum installieren

$ composer require laravel/sanctum
$ php artisan vendor:publish --provider="Laravel\Sanctum\SanctumServiceProvider"
$ php artisan migrate

Tokens ausstellen

<?php
Route::post("/login", function (Request $request) {
    $request->validate(["email" => "required", "password" => "required"]);
    $user = User::where("email", $request->email)->first();
    if (!$user || !Hash::check($request->password, $user->password)) {
        throw ValidationException::withMessages([
            "email" => ["The provided credentials are incorrect."],
        ]);
    }
    $token = $user->createToken("mobile-app")->plainTextToken;
    return response()->json(["token" => $token]);
});

HasApiTokens-Trait

<?php
use Laravel\Sanctum\HasApiTokens;

class User extends Authenticatable
{
    use HasApiTokens, HasFactory, Notifiable;
}

Routen schützen

<?php
// routes/api.php
Route::middleware("auth:sanctum")->group(function () {
    Route::get("/user",  fn(Request $r) => $r->user());
    Route::apiResource("posts", PostController::class);
});

Das Token senden

# HTTP header:
Authorization: Bearer 1|AbCdEf1234567890...

Token-Bereiche (Abilities)

<?php
// Create token with abilities:
$token = $user->createToken("mobile", ["read:posts", "write:comments"])->plainTextToken;

// Check ability:
if ($user->tokenCan("write:comments")) {
    // allowed
}

Tokens widerrufen

<?php
// Revoke current token (logout):
$request->user()->currentAccessToken()->delete();

// Revoke all tokens (logout everywhere):
$request->user()->tokens()->delete();

Token-Ablauf

// config/sanctum.php
"expiration" => 60 * 24 * 7, // 7 days in minutes

SPA-Authentifizierung

Sanctum im Vergleich zu Passport

Zusammenfassung

Kurzer Check