repository·13.x·Indexed 25 days ago
https://github.com/laravel/passportAn OAuth2 server implementation for Laravel that provides a robust way to handle API authentication and issue access tokens. It includes features for managing OAuth2 clients, defining custom scopes, configuring token expiration intervals, and supporting various grant types including implicit, password, and device code grants.
Passport 9.0 allows storing client secrets using Bcrypt hashes. Warning: This process is irreversible.
Before hashing, set your personal access client ID and unhashed secret in your .env file:
PASSPORT_PERSONAL_ACCESS_CLIENT_ID=client-id-value
PASSPORT_PERSONAL_ACCESS_CLIENT_SECRET=unhashed-client-secret-valueThen, register them in the boot method of your AppServiceProvider:
Passport::personalAccessClientId(config('passport.personal_access_client.id'));
Passport::personalAccessClientSecret(config('passport.personal_access_client.secret'));Call Passport::hashClientSecrets() in the boot method of your AppServiceProvider.
Run the following Artisan command to hash all existing client secrets. Back up your database before running this command.
php artisan passport:hashPASSPORT_PERSONAL_ACCESS_CLIENT_ID=client-id-value
PASSPORT_PERSONAL_ACCESS_CLIENT_SECRET=unhashed-client-secret-valuePassport::personalAccessClientId(config('passport.personal_access_client.id'));
Passport::personalAccessClientSecret(config('passport.personal_access_client.secret'));php artisan passport:hashWhen upgrading to version 8.0, ensure your environment meets the following minimum requirements:
To support public clients and PKCE, update the secret column of the oauth_clients table to be nullable:
Schema::table('oauth_clients', function (Blueprint $table) {
$table->string('secret', 100)->nullable()->change();
});OAuth exceptions are now rendered as Passport exceptions. If you explicitly handle League\OAuth2\Server\Exception\OAuthServerException in your exception handler's report method, you must now check for Laravel\Passport\Exceptions\OAuthServerException instead.
Passport 9.0 supports multiple guard user providers. You must add a provider column to the oauth_clients database table. If you have not published Passport migrations, add it manually:
Schema::table('oauth_clients', function (Blueprint $table) {
$table->string('provider')->after('secret')->nullable();
});Starting with Passport 12.0, migrations are no longer automatically loaded from the package directory. You must publish them to your application using the following command:
php artisan vendor:publish --tag=passport-migrationsPassport 13.0 hashes client secrets by default using Laravel's Hash facade. If you are currently storing secrets in plain text, you must run the following Artisan command to hash them:
php artisan passport:hashWhen upgrading to version 10.0, ensure your environment meets the following minimum requirements:
The personal client configuration methods have been removed from the Passport class. You should remove any calls to these methods from your application's service providers.
Passport 13.0 introduces a new schema for oauth_clients that is backward compatible, but it is highly recommended to migrate if you use integer-based client IDs. The new schema replaces user_id with owner_type/owner_id, redirect with redirect_uris (array), and client type columns with a grant_types (array) column.
// Example migration snippet for the new schema
Schema::table('oauth_clients', function (Blueprint $table) {
$table->nullableMorphs('owner', after: 'user_id');
$table->after('provider', function (Blueprint $table) {
$table->text('redirect_uris')->nullable();
$table->text('grant_types')->nullable();
});
});
foreach (Passport::client()->cursor() as $client) {
Model::withoutTimestamps(fn () => $client->forceFill([
'owner_id' => $client->user_id,
'owner_type' => $client->user_id
? config('auth.providers.'.($client->provider ?: config('auth.guards.api.provider')).'.model')
: null,
'redirect_uris' => $client->redirect_uris,
'grant_types' => $client->grant_types,
])->save());
}
Schema::table('oauth_clients', function (Blueprint $table) {
$table->dropColumn(['user_id', 'redirect', 'personal_access_client', 'password_client']);
$table->text('redirect_uris')->nullable(false)->change();
$table->text('grant_types')->nullable(false)->change();
});When upgrading to Passport 13.0, ensure your environment meets the following minimum requirements:
league/oauth2-server has been updated to 9.0. Review its changelog for potential signature changes in methods you might override.App\\Models\\User model must implement the Laravel\\Passport\\Contracts\\OAuthenticatable interface alongside the HasApiTokens trait.When upgrading to version 11.0, ensure your environment meets the following minimum requirements:
Customizing model database connections via migration files has been reverted. To customize the database connection for a model, you must now override the models as described in the official documentation.
The Token model now allows timestamps. If you require timestamps to be disabled for this model, you must override the Token model.
Passport routes have moved to a dedicated route file. You can now remove the Passport::routes() call from your application's service provider. If you previously used routes($callback = null, array $options = []) to overwrite routes, you should now overwrite them directly in your application's web.php route file.