Home > Article > PHP Framework > Laravel development: How to implement SPA and API authentication using Laravel Sanctum?

Laravel development: How to implement SPA and API authentication using Laravel Sanctum?

WBOYOriginal: 2023-06-13 12:36:101142browse

Laravel Sanctum is a lightweight authentication package that allows you to easily implement API authentication and SPA (Single Page Application) authentication in Laravel applications. In this article, we will explore how to use Laravel Sanctum to implement SPA and API authentication.

First, let’s take a look at what SPA and API authentication are.

SPA certification refers to a single-page application that does not reload the entire page, but uses AJAX to request information from the web server to update partial content. When using SPA, APIs need to be authenticated to ensure that only authenticated users can access them.

API authentication refers to the API request authentication process. When a client sends a request, the API needs to verify that the request is from the expected user, thereby ensuring that the API endpoint is only used by authenticated users.

Here are the steps on how to use Laravel Sanctum to implement SPA and API authentication:

1. Install Laravel Sanctum
We can use the composer package manager to install Laravel Sanctum. Run the following command in the Laravel project:

composer require laravel/sanctum

2. Run the Laravel Sanctum installer
Laravel Sanctum provides an installer that can automatically configure our application during installation. We can run this installer using the following command:

php artisan vendor:publish --provider="LaravelSanctumSanctumServiceProvider"

3. Run migration
We need to run Sanctum migration to create the necessary database tables to support Sanctum operations. Run the following command:

php artisan migrate

4. Configure the application
We need to add Laravel Sanctum to our middleware stack:

'api' => [
    'middleware' => ['auth:sanctum'],
    'throttle:60,1',
    'prefix' => 'api',
    'namespace' => 'AppHttpControllersAPI',
],

5. Issue authentication tokens to users
In Laravel Sanctum, we can use the tokenCan method to check whether a token has specific API permissions. We can issue an authentication token to the user using the createToken method:

use IlluminateHttpRequest;

/**
 * Store a newly created resource in storage.
 *
 * @param  IlluminateHttpRequest  $request
 * @return IlluminateHttpResponse
 */
public function store(Request $request)
{
    $user = User::find(1);
    $token = $user->createToken('token-name', ['server:update'])->plainTextToken;

    return response()->json([
        'access_token' => $token,
        'token_type' => 'Bearer',
    ]);
}

This will create a token named 'token-name' for the user, which has server:update permissions.

6. Protect API endpoints
In our controller, we can use the "middleware" method to protect API endpoints:

public function update(Request $request, $id)
{
    if (!$request->user()->tokenCan('server:update')) {
        abort(403, 'Unauthorized');
    }

    // Update the server
}

In this example, we only allow those with Users with server:update permissions access the update method.

7. Using authentication tokens in SPA
In our SPA, we can use Sanctum’s @auth and @csrf Blade instructions to obtain the authentication token:

<head>
    <meta charset="utf-8">
    <meta name="viewport" content="width=device-width, initial-scale=1">
    <title>Laravel</title>

    <!-- Fonts -->
    <link href="https://fonts.googleapis.com/css?family=Nunito:200,600" rel="stylesheet">
    <script src="{{ asset('js/app.js') }}" defer></script>

    <!-- Styles -->
    <link href="{{ asset('css/app.css') }}" rel="stylesheet">

    <!-- Meta -->
    <meta name="csrf-token" content="{{ csrf_token() }}">
</head>
<body>
    <div id="app">
        <nav class="navbar navbar-expand-md navbar-light bg-white shadow-sm">
            <div class="container-fluid">
                <a class="navbar-brand" href="{{ url('/') }}">
                    {{ config('app.name', 'Laravel') }}
                </a>
                <button class="navbar-toggler" type="button" data-toggle="collapse" data-target="#navbarSupportedContent" aria-controls="navbarSupportedContent" aria-expanded="false" aria-label="{{ __('Toggle navigation') }}">
                    <span class="navbar-toggler-icon"></span>
                </button>

                <div class="collapse navbar-collapse" id="navbarSupportedContent">
                    <!-- Left Side Of Navbar -->
                    <ul class="navbar-nav mr-auto">

                    </ul>

                    <!-- Right Side Of Navbar -->
                    <ul class="navbar-nav ml-auto">
                        <!-- Authentication Links -->
                        @guest
                            <li class="nav-item">
                                <a class="nav-link" href="{{ route('login') }}">{{ __('Login') }}</a>
                            </li>
                            @if (Route::has('register'))
                                <li class="nav-item">
                                    <a class="nav-link" href="{{ route('register') }}">{{ __('Register') }}</a>
                                </li>
                            @endif
                        @else
                            <li class="nav-item dropdown">
                                <a id="navbarDropdown" class="nav-link dropdown-toggle" href="#" role="button" data-toggle="dropdown" aria-haspopup="true" aria-expanded="false" v-pre>
                                    {{ Auth::user()->name }}
                                </a>

                                <div class="dropdown-menu dropdown-menu-right" aria-labelledby="navbarDropdown">
                                    <a class="dropdown-item" href="{{ route('logout') }}"
                                       onclick="event.preventDefault();
                                                     document.getElementById('logout-form').submit();">
                                        {{ __('Logout') }}
                                    </a>

                                    <form id="logout-form" action="{{ route('logout') }}" method="POST" style="display: none;">
                                        @csrf
                                    </form>
                                </div>
                            </li>
                        @endguest
                    </ul>
                </div>
            </div>
        </nav>
        <main class="py-4">
            @yield('content')
        </main>
    </div>
    @auth
        <script>
            window.Laravel = {!! json_encode([
                'csrf_token' => csrf_token(),
                'api_token' => Auth::user()->api_token
            ]) !!};
        </script>
    @endauth
</body>

In this example, we use Sanctum's @auth and @csrf Blade directives to obtain user authentication tokens and CSRF tokens.

That’s all about how to implement SPA and API authentication using Laravel Sanctum. Using Laravel Sanctum makes it easy to secure our API endpoints and SPA applications and helps us implement best security practices.

The above is the detailed content of Laravel development: How to implement SPA and API authentication using Laravel Sanctum?. For more information, please follow other related articles on the PHP Chinese website!

Statement：

The content of this article is voluntarily contributed by netizens, and the copyright belongs to the original author. This site does not assume corresponding legal responsibility. If you find any content suspected of plagiarism or infringement, please contact admin@php.cn

Previous article：Laravel development: How to analyze and optimize applications using Laravel Telescope?Next article：Laravel development: How to analyze and optimize applications using Laravel Telescope?

See more

Laravel development: How to implement SPA and API authentication using Laravel Sanctum?

Related articles