Question: how to best design authentication?

[axtg]

I've got a question, I'm using the Orion happily locally with Insomnia to build my endpoints. Works perfect, very happy with this well-thought-through and structured approach.

But now I need to setup authentication. Login, register, reset password etc.
I normally use Fortify for this, but this leverages the X-XSRF-TOKEN approach (web), instead of Bearer (API). I tried setting up Sanctum now too, but I'm getting confused on the best-practice approach.

Any thoughts or experiences that can help me move forward?

Thanks.

[alexzarbn]

Hi @axtg,

It basically depends on where you would perform the authentication from. Is it a first-party SPA? A mobile app? Another backend service?

In most cases, I highly suggest using Sanctum (Cookie for first-party SPA, Bearer token for mobile apps), because it provides literally everything you need.

However, if you plan to make your app an OAuth identity provider, then Passport should be the way to go from the very beginning.

[axtg]

@alexzarbn Appreciate that line of thought. So here is what I tried doing in Insomnia after installing Sanctum:

1. Call /sanctum/csrf-cookie/ to get the cookie
2. Call /login (successfully) with the x-xsrf-token in the header and user details as post vars (Fortify controller)
3. Call /api/user (OrionResource) with the x-xsrf-token in the header

Step 3 gives me an unauthenticated message. If I try the Bearer token for the user, it does work. So I tried changing in api.php the guard to auth:web, but that does not work. That beggs the question, can I use a single API endpoint for both a SPA and external app (e.g. Zapier/ Integromat)? I'd live to give my fictive users the opportunity to do so.

But I think I am missing one crucial point about Sanctum.

Thanks for the help!

[alexzarbn]

@axtg Please read Sanctum's Configuration and Orion's Authorization documentation.

Yes, you can use the same endpoint, the only difference would be the way you authenticate: from within your app - it is a first-party authorization using cookie, from any external service - it can be a personal access token.

[axtg]

Wow. Okay, so this took me a while.
Stateless was working okay, with the Sanctum bearer token. But stateful (for SPA) did not work. And finally, I figured it out. The ensurefrontendarestateful middleware checks for the referer of the request. So without that added to the Header it doesn't work. Hope that might help someone else when testing through Postman or Insomnia.

All good now.