Laravel Authentication & Authorization

Documentation

Authentication

• authentication.md – Authentication basics
• sanctum.md – API token authentication
• passport.md – OAuth2 server
• fortify.md – Authentication backend
• socialite.md – Social authentication
• starter-kits.md – Breeze & Jetstream

Authorization

• authorization.md – Gates & Policies

Security

• verification.md – Email verification
• passwords.md – Password reset
• encryption.md – Encryption
• hashing.md – Hashing
• csrf.md – CSRF protection
• session.md – Session management

Sanctum Setup

use Laravel\Sanctum\HasApiTokens;

class User extends Authenticatable
{
    use HasApiTokens, HasFactory, Notifiable;
}

Policy

<?php

declare(strict_types=1);

namespace App\Policies;

final class PostPolicy
{
    public function update(User $user, Post $post): bool
    {
        return $user->id === $post->user_id;
    }

    public function delete(User $user, Post $post): bool
    {
        return $user->id === $post->user_id || $user->isAdmin();
    }
}

Gates

Gate::define('admin', fn (User $user) => $user->role === UserRole::Admin);

// Usage
if (Gate::allows('admin')) { }