Passport: How Passport identify what user are requesting the Access Token?

[ilvalerione]

Hello Laravel team and thanks for this package!

There is only one thing that i don't understand in the Authorization process.

How Passport identify what user are requesting the Access Token?

Step 1
In the classic example of Passport usage a client needs to perform a request like below:

`$query = http_build_query([
'client_id' => 1,
'redirect_uri' => 'http://consumer.dev/callback',
'response_type' => 'code',
'scope' => 'conference'
]);

// Redirect the user to the OAuth authorization page
return redirect('http://passport.dev/oauth/authorize?' . $query);`

Step 2
Passport server open the "Approval Authorization view" like this:

And here there aren't Users Informations about who are requesting the Access Token by this external client.

Step 3
Passport server return an access token in json response and now i'm able to call a protected routes by "auth:api" middleware.

As Taylor showed in his example i can call the test route to verify if Passport are working:

Route::get('/user', function (Request $request) { return $request->user(); });

How does Passport know which user must be authenticated?

I requested the Access Token sending only client informations without attaching any user information.
How does the Passport server to know which user is authenticating by the external client?

How can i show the user informations in the "Authorization view"?

Thanks a lot for your support.

[RyanTheAllmighty]

You can access $user in your authorisation view which will be your defined authentication model instance for the user being authorised.

For instance in my authorisation view I do the following:

<p>Logged in as <strong>{{ $user->username }}</strong>. <a href="/logout/return">Not You?</a></p>

Passport knows which user it's authenticating against since the user must be logged in before seeing the authorisation screen, so it knows which user is logged in.