Authentication guards in Laravel - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ component_behavior

intermediate

What happens when a user tries to access a route protected by the 'auth' guard without being logged in?

Consider a Laravel route protected by the default 'auth' guard. What is the behavior when an unauthenticated user tries to access this route?

Laravel

Route::middleware('auth')->get('/dashboard', function () {
    return 'Dashboard';
});

A The user sees a 404 Not Found error.

B The user is redirected to the login page automatically.

C The user can access the route without restrictions.

D The application throws a server error (500).

💡 Hint

Think about what Laravel does when authentication fails on routes protected by 'auth' middleware.

Laravel's 'auth' middleware checks if the user is logged in. If not, it redirects to the login page by default.

📝 Syntax

intermediate

Which code snippet correctly defines a custom guard in Laravel's auth configuration?

Given the need to add a custom guard named 'admin' using the 'session' driver and 'admins' provider, which option is correct?

A "admin" => ["driver" => "token", "provider" => "admins"]

B "admin" => ["driver" => "session"]

C "admin" => ["provider" => "admins", "driver" => "session"]

D "admin" => ["driver" => "session", "provider" => "admins"]

💡 Hint

Remember the order of keys does not matter, but all required keys must be present.

A guard requires both 'driver' and 'provider' keys. Option D correctly includes both with proper values.

🔧 Debug

advanced

Why does the following code throw an error when trying to authenticate with a custom guard?

Examine this Laravel controller snippet:

if (Auth::guard('admin')->attempt(['email' => $email, 'password' => $password])) {
    return redirect()->intended('/admin/dashboard');
}

The error says: Call to undefined method attempt() on null. What is the cause?

A The 'attempt' method does not exist on any guard in Laravel.

B The 'email' and 'password' keys are incorrect; they should be 'username' and 'pass'.

C The 'admin' guard is not defined in config/auth.php, so Auth::guard('admin') returns null.

D The Auth facade is not imported, causing the method call to fail.

💡 Hint

Check if the guard name matches the configuration.

If the guard name is not defined, Auth::guard('admin') returns null, so calling attempt() causes an error.

🧠 Conceptual

advanced

What is the main difference between 'session' and 'token' drivers in Laravel authentication guards?

Laravel supports multiple drivers for authentication guards. What is the key difference between the 'session' and 'token' drivers?

A 'session' driver uses cookies to maintain login state, while 'token' driver uses API tokens for stateless authentication.

B 'session' driver is for API authentication, and 'token' driver is for web sessions.

C 'session' driver requires manual token management, 'token' driver automatically manages sessions.

D 'session' driver encrypts passwords, 'token' driver does not.

💡 Hint

Think about how web apps keep users logged in versus how APIs authenticate requests.

The 'session' driver uses cookies and sessions to keep users logged in on web apps. The 'token' driver uses tokens passed with each request, suitable for APIs.

❓ state_output

expert

What is the value of Auth::guard('web')->user() after logging in with a custom user provider?

Assume you have a custom user provider configured for the 'web' guard that fetches users from a special table. After a successful login, what does Auth::guard('web')->user() return?

A An instance of the user model returned by the custom provider representing the logged-in user.

B Null, because custom providers do not support the user() method.

C A boolean true indicating successful authentication.

D An array of all users in the custom table.

💡 Hint

Consider what the user() method returns after authentication.

After login, user() returns the authenticated user model instance from the provider, even if custom.