How Laravel middleware auth:api detect token from cookie?

Question

I just trying to makes my auth flow more secure using a cookie on Laravel 5.7

Here my code

/**
 * auth logic
 */
return response()->json(["status" => "logged in"], 200)->cookie('token', $token, $lifetime);

Then the cookie will be saved on the browser and will be used on every request.

On header with Axios

"cookie":"token={token}"

And I validate the auth using default middleware

Route::group(['middleware' => ['auth:api']])

But the auth:api did not recognize it, I can make custom middleware by manually detect the cookie, but I can't use the auth()->user() function on it. Is there any solution for this?

if you want to use cookie, just use default auth middleware instead of auth:api — Muhammad Dyas Yaskur
– Muhammad Dyas Yaskur, Commented Jun 3, 2021 at 7:40

Dharman · Accepted Answer · 2021-06-03 09:46:18Z

3

From your sample code I believe your app is built on a stateless architecture where you have your JavaScript client and laravel api. Now I am a bit confused as to why you do not want the client storing the token, if you just want to escape cross site scripting vulnerability (XSS) then you have to prepare to deal with cross site request forgery (CSRF) if you store the token in the browsers cookie. Regarding the middleware not being able to find the token, by default the middleware is configured to lookup tokens in the request header (specifically the Authorization header) so if you decide to store it in the cookie, you have to find a way to change the token lookup in the api middleware which unfortunately I have not done before in laravel.

edited Jun 3, 2021 at 9:46

Dharman♦

33.9k27 gold badges106 silver badges157 bronze badges

answered Jun 3, 2021 at 9:40

yhiamdan

1351 silver badge10 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

apokryfos · Accepted Answer · 2021-06-03 07:55:13Z

1

APIs don't generally store and send cookies. Therefore the api token authentication guard will not look for the token in a cookie. There are multiple options you can send it as though the easiest one in axios:

{
   headers: {
     Authorization: `Bearer ${token}`
   }
}

answered Jun 3, 2021 at 7:55

apokryfos

40.9k11 gold badges85 silver badges128 bronze badges

2 Comments

Rizal Yogi Pratama Over a year ago

currently, i'm using this, but i don't want the frontend side to store the token but if we used cookie, the browser would be auto save the cookie

apokryfos Over a year ago

You really should not use API routes for browser interactions. If using the browser and relying on cookies then use the session and the web auth guard

Collectives™ on Stack Overflow

How Laravel middleware auth:api detect token from cookie?

2 Answers 2

Comments

2 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

2 Comments

Your Answer

Sign up or log in

Post as a guest

Related