Laravel-permission: Using Laravel-permission middleware in API routes

[jurgenbosch]

I realize this might be a dumb question but do you guys have experience with securing API calls using laravel-permission plugin in API routes?

The user is always making the request through Javascript but since the code is executed at the server auth()->user() is null.

Anyone has any experience with this?

[jurgenbosch]

Any ideas?

[drbyte]

How are your users authenticating when connecting with javascript? What sort of auth are you implementing here?

[jurgenbosch]

I fixed it.

I added Laravel passport to the application.
See: https://laravel.com/docs/5.6/passport and also pay attention to the Javascript API section https://laravel.com/docs/5.6/passport#consuming-your-api-with-javascript

Once done I added a group in my api routes with 2 middlewares; auth:api and role:manager.
Done! :)

Passport with javascript support creates a cookie that it sends with every request.
Laravel is able to validate that cookie for authentication on the user that is performing the request. Once that user is known the role or permission can be checked by Spatie's laravel-permission package.

Actually quite cool 🥇

This is how my route group looks like in api.php
Route::group(['middleware' => ['auth:api', 'role:manager']], function() { // Routes here });

[drbyte]

... creates a cookie that it sends with every request.
Laravel is able to validate that cookie for authentication on the user that is performing the request. Once that user is known the role or permission can be checked by Spatie's laravel-permission package.

👍

[dbarrington]

I fixed it.

I added Laravel passport to the application.
See: https://laravel.com/docs/5.6/passport and also pay attention to the Javascript API section https://laravel.com/docs/5.6/passport#consuming-your-api-with-javascript

Once done I added a group in my api routes with 2 middlewares; auth:api and role:manager.
Done! :)

Passport with javascript support creates a cookie that it sends with every request.
Laravel is able to validate that cookie for authentication on the user that is performing the request. Once that user is known the role or permission can be checked by Spatie's laravel-permission package.

Actually quite cool 🥇

This is how my route group looks like in api.php
Route::group(['middleware' => ['auth:api', 'role:manager']], function() { // Routes here });

@jurgenbosch Thanks for this info, it was a big help.