How does Laravel handle authentication and authorization?

Authentication in Laravel

Authentication is the process of verifying the identity of a user. Laravel makes it easy to set up authentication with its built-in tools. Here’s how it works:

1. Setting Up Authentication

Laravel comes with an authentication scaffolding out of the box, which you can generate using Laravel Breeze, Jetstream, or the default authentication system.

To quickly generate authentication routes, views, and controllers, you can use Laravel Breeze or Laravel Jetstream (for more complex apps).

For a simple setup with Laravel Breeze, you can run:

composer require laravel/breeze --dev
php artisan breeze:install
npm install && npm run dev
php artisan migrate

This command will set up routes for registration, login, password resets, and basic user authentication views and controllers.

2. The Auth Facade

Laravel uses the Auth facade to manage authentication. Here’s an example of checking if a user is logged in:

if (Auth::check()) {
    // The user is logged in
    return view('dashboard');
}

You can also get the authenticated user with:

$user = Auth::user();

3. Guarding Routes (Authentication Middleware)

Laravel protects routes using middleware. The auth middleware ensures that only authenticated users can access certain routes.

Example of protecting a route in routes/web.php:

Route::get('/dashboard', function () {
    return view('dashboard');
})->middleware('auth');

This will redirect any unauthenticated user to the login page when trying to access /dashboard.

4. Login, Register, and Password Management

The authentication scaffolding provides routes for:

• Login: /login
• Register: /register
• Forgot Password: /password/reset

These routes handle everything from displaying login and registration forms to validating credentials and authenticating the user. Laravel uses controllers like Auth\LoginController, Auth\RegisterController, and Auth\ForgotPasswordController to manage this process behind the scenes.

5. Custom Authentication Logic

If you need to customize authentication logic (e.g., to add additional validation during login), you can modify or extend the LoginController. For example, adding custom validation:

protected function validateLogin(Request $request)
{
    $request->validate([
        'email' => 'required|email',
        'password' => 'required|min:6',
    ]);
}

Authorization in Laravel

Once a user is authenticated, you need to handle authorization, which determines what an authenticated user can do within the application. Laravel provides two main ways to manage authorization:

• Gates (simpler, function-based)
• Policies (more structured, class-based)

1. Gates

A Gate is a simple closure-based authorization check. It is defined in App\Providers\AuthServiceProvider and is used for simple authorization logic that doesn’t require complex roles.

Example of defining a gate in AuthServiceProvider:

In this example, the gate update-post allows users to update posts they own.

To check if a user is authorized to perform an action, you can use:

if (Gate::allows('update-post', $post)) {
    // The current user can update the post
}

Alternatively, you can use:

if (Gate::denies('update-post', $post)) {
    // The user cannot update the post
}

2. Policies

Policies are a more organized way of handling authorization for models. They define a class where you can handle multiple authorization rules related to a specific model (e.g., users, posts).

You can generate a policy using Artisan:

php artisan make:policy PostPolicy

This will create a policy in app/Policies/PostPolicy.php. You can define authorization methods inside the policy:

class PostPolicy
{
    public function update(User $user, Post $post)
    {
        return $user->id === $post->user_id;
    }

    public function delete(User $user, Post $post)
    {
        return $user->id === $post->user_id;
    }
}

To apply the policy to the Post model, register it in AuthServiceProvider:

protected $policies = [
    Post::class => PostPolicy::class,
];

You can then use the authorize method in controllers to check authorization:

public function update(Request $request, Post $post)
{
    $this->authorize('update', $post);
    // The user can update the post
}

The authorize method automatically checks the related policy for the Post model and denies access if the authorization fails.

3. Roles and Permissions

While Laravel doesn’t provide a built-in role and permission system, you can use packages like Spatie Laravel Permissions to handle role-based access control (RBAC).

To use this package:

1. Install it via Composer:

composer require spatie/laravel-permission

2. Publish and migrate the package:

php artisan vendor:publish --provider="Spatie\Permission\PermissionServiceProvider"
php artisan migrate

3. You can now assign roles and permissions to users:

use Spatie\Permission\Models\Role;
use Spatie\Permission\Models\Permission;

$role = Role::create(['name' => 'admin']);
$permission = Permission::create(['name' => 'edit posts']);

$role->givePermissionTo($permission);
$user->assignRole('admin');

To check a user’s role or permission, you can use:

if ($user->hasRole('admin')) {
    // The user is an admin
}

if ($user->can('edit posts')) {
    // The user can edit posts
}

Conclusion

In Laravel, authentication and authorization are straightforward to implement thanks to built-in scaffolding, middleware, and helper methods. Here’s a quick summary:

• Authentication: Managed using routes, controllers, and the Auth facade. Laravel provides scaffolding to quickly set up user login, registration, and password management.
• Authorization: Managed using Gates (for simple authorization) and Policies (for more structured, model-based authorization). You can also add role-based access control with packages like Spatie’s Permissions package.