Laravel Authentication

Laravel authentication gives your app secure login, registration, password reset and email verification with very little code. The quickest route is a starter kit like Laravel Breeze, but it helps to understand the Auth tools underneath.

Installing Laravel Breeze

Breeze scaffolds login, register, password reset, email verification and profile pages using Blade (or React/Vue with Inertia).

composer require laravel/breeze --dev
php artisan breeze:install blade
php artisan migrate
npm install && npm run dev

INFO  Breeze scaffolding installed successfully.
Routes added: /login, /register, /forgot-password, /dashboard, /profile

Working With the Logged-in User

<?php
use Illuminate\Support\Facades\Auth;

if (Auth::check()) {
    $user = Auth::user();     // or auth()->user(), or $request->user()
    echo "Hi {$user->name} (#" . Auth::id() . ")";
}

Hi Naeem (#1)

Manual Login and Logout

Auth::attempt checks the email and hashed password for you. Regenerate the session after login and invalidate it on logout.

<?php
public function login(Request $request)
{
    $credentials = $request->validate([
        'email' => ['required', 'email'],
        'password' => ['required'],
    ]);

    if (Auth::attempt($credentials, $request->boolean('remember'))) {
        $request->session()->regenerate();
        return redirect()->intended('/dashboard');
    }

    return back()->withErrors(['email' => 'These credentials do not match our records.'])
                 ->onlyInput('email');
}

public function logout(Request $request)
{
    Auth::logout();
    $request->session()->invalidate();
    $request->session()->regenerateToken();
    return redirect('/');
}

Correct password -> redirect /dashboard
Wrong password   -> back to /login with error under email

Protecting Routes and Views

<?php
Route::middleware(['auth', 'verified'])->group(function () {
    Route::get('/dashboard', DashboardController::class)->name('dashboard');
});

{{-- Blade --}}
@auth
    <a href="{{ route('dashboard') }}">Dashboard</a>
@else
    <a href="{{ route('login') }}">Log in</a>
@endauth

Guest visiting /dashboard -> redirected to /login

Authorization With Policies

Authentication answers "who are you?"; authorization answers "are you allowed?". A policy holds the rules for one model.

php artisan make:policy PostPolicy --model=Post

<?php
class PostPolicy
{
    public function update(User $user, Post $post): bool
    {
        return $user->id === $post->user_id;
    }
}

// Controller
Gate::authorize('update', $post);

{{-- Blade --}}
@can('update', $post)
    <a href="{{ route('posts.edit', $post) }}">Edit</a>
@endcan

Author     -> sees Edit link, can update
Other user -> 403 This action is unauthorized.

Frequently asked questions

Which Laravel starter kit should I use?

Breeze is the simplest and great for learning. Jetstream adds teams and two-factor authentication. Newer Laravel releases also ship React, Vue and Livewire starter kits.

How does Laravel store passwords?

Passwords are hashed with bcrypt (or Argon2) through the Hash facade. The User model casts password as hashed, so plain text is never saved.

What is the difference between authentication and authorization?

Authentication verifies identity (logging in). Authorization checks permissions, using gates and policies in Laravel.