How to authenticate Mobile App using Laravel Sanctum & Laravel Fortify
HTML-код
- Опубликовано: 29 сен 2024
- Authenticating mobile apps can be tricky because you can't use the session based authentication that Laravel Sanctum offers. Instead, we need to use a token based authentication which is also offered by Laravel Sanctum. In this video, we authenticate a react native mobile app using the existing Laravel Fortify API's backend that we used to authenticate the SPA in this series with few modifications. This allows us to keep all of fortify's features & have the ability to authenticate both mobile apps & SPAs.
🤝 You can support me by giving my videos a 👍 & by subscribing to the channel ✔️
--- Note ---
At 07:00 another way of deleting the correct token is by calling currentAccessToken() method on the user model & deleting that instead of deleting all user's tokens. More details here: laravel.com/do...
--- Source Code ---
Back-End (Laravel): github.com/gge...
Front-End (React Native): github.com/gge...
-- Laravel Fortify Without Jetstream Series --
Laravel Fortify Without Jetstream Feature - • Laravel Fortify SPA Au...
Add Two-Factor Authentication Feature - • How to add Two-Factor ...
Add User Registration Feature - • How to add User Regist...
Add Account Profile & Password Updates Feature - • How to add Account Pro...
Add Password Reset Feature - • How to add Password Re...
Authenticate Mobile App With Fortify & Sanctum - • How to authenticate Mo...
Updates to Laravel Fortify - • Updates to the Laravel...
8 years of watching youtube coding tutorials and this has to be one of the clearest, straight forward tutorial. Thank you Gio
Thank you so much 🙏 💙
This is just showing how to authenticate your app with tokens not how to use fortify with tokens.... Very misleading
Fortify does not have token based authentication, that's Laravel Sanctum. This video shows how to authenticate mobile app using laravel sanctum & laravel fortify because this series is about Laravel Fortify. I think you might be confusing fortify with sanctum. Here is a snippet from laravel docs:
"If you are attempting to manually build the authentication layer for an application that offers an API or serves as the backend for a single-page application, it is entirely possible that you will utilize both Laravel Fortify (for user registration, password reset, etc.) and Laravel Sanctum (API token management, session authentication)." laravel.com/docs/9.x/fortify#laravel-fortify-and-laravel-sanctum
Hope this clears up any confusion. So no, there is nothing misleading about this video.
Wonderful explanation
Glad you liked it 👍
Hey Gio, if we need to authenticate a 3rd party app (no user) on top of existing SPA (user) authentication to be able to consue some endpoints, can we still use Sanctum as the same approach as this one? Or this is a completely separate authentication outside of Sanctum since there is no user involved? Thank you.
You could use sanctum tokens but those are for user. Authenticating non users might be a bit tricky, don't think sanctum would work in that case. Might need to implement it on your own
@@ProgramWithGio Thanks man, you are really such a blessing to us PHP developers :) keep up the good content. Bdw, looking forward to your Laravel the Right Way Course
Thank you for this tutorial. I have a mobile react-native app that was working fine, using Laravel Sanctum for API calls on the production server until I added a sub-domain to my domain. Now, I can still log in via the mobile app but every subsequent API call gives a 401 error, "Unauthenticated." Although this API call still works very well on my local machine. Please, kindly assist me.
It's hard to help without seeing the code & debugging. If it works on local but fails on prod then it has to be some configuration. Maybe related to session domain env variable
@@ProgramWithGio I never set the SESSION_DOMAIN in the env file, since my API calls are from the mobile app. Is there any other channel to paste my codes?
@@akeemsalami1854 then u are authenticating using token and not sessions. I would debug the token part and see how it's being passed.
@@akeemsalami1854 you can post it on Laracasts to get help on specific code. Someone may have had same issue and may be able to help
Hopefully you will try Flutter too
Yes, I want to try flutter, it's in my queue of the things I want to learn.
Hey Gio, how would you implement a refresh token for sanctum token based authentication? I see on forums laravel passport mentioned, but I don't need the complexity. Thanks for the awesome work!
Hey, I would issue a new token and revoke the old one.
Will this still be working with fortify features if we didn't use session based authentication? I unintentionally made token based authentication and storing it via storage when I was in the middle of your series and it became a hot mess when I started for the 2fa. That is why I trashed that and restarted a new project file and do it all over.
Or it's just me and my newbie approach that I was not able to do it properly haha
I haven't tried but I think you should be able to implement 2FA on token based auth.
Great video Gio. I'd like to use Fortify's 2FA feature as part of the mobile app authentication flow. So... user enters their username and password, followed by their 2FA passcode, and only then is the token returned.
What would be the best way to do that?
Thank you. You would need to authenticate with username/password first, then ask for 2FA and if successful then get the token. If you want to cut the extra step and have 2FA code be entered together with username and password then you will probably need to use custom action for it to authenticate user. Haven't tried doing that way
I don't get the naming. Mobile authentication has nothing to do with user authentication. Mobile authentication is where you make sure only your app can access an API.
Not sure I understand. That's how it's referred to in Laravel docs and how developers refer to it, hence why I picked that title because that's what they search for.
From Laravel docs: "Mobile Application Authentication"
laravel.com/docs/8.x/sanctum#mobile-application-authentication
The begining of the videos or in the videos there is references to previous videos but the videos you have dont show which is which your talking about, lets say sanctum videos or fortify videos
It's a playlist, so if you go to the playlist it's sorted so you'll know which is previous. In the description there are links for videos as well.
And what if you are using firebase auth is it the same?
Not sure, I have not used firebase
Please make series with laravel + react Native. Maybe small shop wth stripe subscriptions :)
Thanks for the suggestion 👍
@@ProgramWithGio Great series abount nextjs with laravel auth. Lets continue :)
For example if laravel want to serve list of something as API/APIs for both first-party SPA and third-party SPA (or Mobiles), what is the best practice? (actually simplest and pretty clean ways)
1- Create TWO separately APIs for each SPA.
2- Create ONE API for both SPA (in this case, How do we differentiate between two requests?)
Not sure I fully understand the question but if the SPAs/Mobile Apps fetch the same data just display differently then best to have a single API. Sounds like GraphQL would be ideal since it would allow your SPA/Mobile App to fetch data in the format that it needs without the need to have custom endpoints or even a separate API
@@ProgramWithGio actually what operations need to be implemented separately for mobile and SPA like login and logout APIs u did?
@@homayoonsoheyli9175 yea, because login from mobile app will happen using tokens, same for logout it has to revoke the token. That's what I did in this video, had separate endpoint for logging in using tokens
how about social logins?
You can use Laravel Socialite package for that. I'll make a video about it soon
@@ProgramWithGio I mean using social logins in your mobile apps.
@@jahadempire7934 I haven't done that yet
@@jahadempire7934 I think Socialite can be used for that also, it has option to do stateless authentication. I'll be reviewing it soon after my PHP course and make a video about it