repository·4.x·Indexed 25 days ago
https://github.com/laravel/sanctumA featherweight authentication system for Single Page Applications (SPAs) and simple APIs. It provides lightweight authentication without the complexity of full OAuth2 implementations, featuring personal access tokens, stateful domain configuration for SPAs, and token ability verification. Includes tools for pruning expired tokens via the `sanctum:prune-expired` command and customizable guards and middleware.
When upgrading to Sanctum 4.0, ensure your environment meets the new minimum requirements:
In Sanctum 4.0, migrations are no longer automatically loaded from the package's internal directory. You must manually publish them to your application's migration directory by running the following command:
php artisan vendor:publish --tag=sanctum-migrationsIn Sanctum 4.0, you must update the middleware array in your config/sanctum.php file to use the fully qualified class names for authenticate_session, encrypt_cookies, and validate_csrf_token.
'middleware' => [
'authenticate_session' => Laravel\Sanctum\Http\Middleware\AuthenticateSession::class,
'encrypt_cookies' => Illuminate\Cookie\Middleware\EncryptCookies::class,
'validate_csrf_token' => Illuminate\Foundation\Http\Middleware\ValidateCsrfToken::class,
],To customize Sanctum's behavior or manage its database schema, you can publish its configuration file and migration files using the following Artisan commands:
php artisan vendor:publish --tag=sanctum-migrationsphp artisan vendor:publish --tag=sanctum-configThe AuthenticateSession middleware uses the sanctum.guard configuration key to determine which authentication guards should be monitored for session validity. This middleware ensures that if a user's password changes, their existing sessions are invalidated across the specified guards.
You can define one or more guards in your config/sanctum.php file.
Guard iterates through a list of authentication guards defined in your configuration to resolve the user. You can specify which guards Sanctum should check by setting the sanctum.guard configuration key. This value can be a single string or an array of strings. By default, it uses the web guard.To enable stateful authentication for your Single Page Application (SPA), you must define your frontend domains in the sanctum.stateful configuration array. The EnsureFrontendRequestsAreStateful middleware uses this list to determine if an incoming request should be treated as a first-party request, enabling session-based authentication and CSRF protection.
If you use a placeholder for the current host, you can use Sanctum::$currentRequestHostPlaceholder (though typically you will list specific domains like frontend.example.com).
authenticateAccessTokensUsing to provide a custom callback for authenticating access tokens. This allows you to override the default logic used to validate the token against the database.actingAs method allows you to mock an authenticated user with a specific set of token abilities. This is primarily used in testing environments to simulate requests made by a user with certain permissions.The CheckScopes middleware is used to verify if an incoming request's token possesses all the required scopes.
Note: This middleware is deprecated. You should use Laravel\Sanctum\Http\Middleware\CheckAbilities instead. CheckScopes internally calls CheckAbilities and re-throws MissingAbilityException as a MissingScopeException.
tokenable relationship allows you to retrieve the model instance (e.g., a User) that the access token belongs to using a polymorphic relationship.