Question: how to best design authentication? about laravel-orion HOT 4 CLOSED

Hi @axtg,

It basically depends on where you would perform the authentication from. Is it a first-party SPA? A mobile app? Another backend service?

In most cases, I highly suggest using Sanctum (Cookie for first-party SPA, Bearer token for mobile apps), because it provides literally everything you need.

However, if you plan to make your app an OAuth identity provider, then Passport should be the way to go from the very beginning.

from laravel-orion.

Wow. Okay, so this took me a while.
Stateless was working okay, with the Sanctum bearer token. But stateful (for SPA) did not work. And finally, I figured it out. The ensurefrontendarestateful middleware checks for the referer of the request. So without that added to the Header it doesn't work. Hope that might help someone else when testing through Postman or Insomnia.

All good now.

from laravel-orion.

@alexzarbn Appreciate that line of thought. So here is what I tried doing in Insomnia after installing Sanctum:

1. Call /sanctum/csrf-cookie/ to get the cookie
2. Call /login (successfully) with the x-xsrf-token in the header and user details as post vars (Fortify controller)
3. Call /api/user (OrionResource) with the x-xsrf-token in the header

Step 3 gives me an unauthenticated message. If I try the Bearer token for the user, it does work. So I tried changing in api.php the guard to auth:web, but that does not work. That beggs the question, can I use a single API endpoint for both a SPA and external app (e.g. Zapier/ Integromat)? I'd live to give my fictive users the opportunity to do so.

But I think I am missing one crucial point about Sanctum.

Thanks for the help!

from laravel-orion.

@axtg Please read Sanctum's Configuration and Orion's Authorization documentation.

Yes, you can use the same endpoint, the only difference would be the way you authenticate: from within your app - it is a first-party authorization using cookie, from any external service - it can be a personal access token.

from laravel-orion.