Overview - Authentication guards

What is it?

Authentication guards in Laravel are tools that control how users are authenticated for each request. They decide how to check if a user is logged in and what user data to use. Guards help Laravel know who is making a request and if they have permission to access certain parts of the app. They work behind the scenes to keep your app secure.

Why it matters

Without authentication guards, Laravel wouldn't know how to verify users or protect routes properly. This would make apps vulnerable to unauthorized access, risking user data and app integrity. Guards solve the problem of managing different ways users can log in, like via web or API, making security flexible and reliable.

Where it fits

Before learning authentication guards, you should understand basic Laravel routing and middleware. After guards, you can learn about Laravel's authentication scaffolding, policies, and authorization to control user permissions more deeply.

Mental Model

Core Idea

Authentication guards are the gatekeepers that check who you are and how you prove it before letting you into different parts of a Laravel app.

Think of it like...

Think of authentication guards like security checkpoints at different doors in a building. Each checkpoint checks your ID in its own way before letting you enter.

┌───────────────┐
│  Incoming     │
│  Request      │
└──────┬────────┘
       │
       ▼
┌───────────────┐
│ Authentication│
│ Guard         │
│ (Checks user) │
└──────┬────────┘
       │
       ▼
┌───────────────┐
│ Access to     │
│ Route/Resource│
└───────────────┘

Build-Up - 7 Steps

1

FoundationWhat is an Authentication Guard

Concept: Introduces the basic idea of guards as the part of Laravel that checks user identity.

In Laravel, a guard defines how users are authenticated for each request. It tells Laravel which user provider to use and how to retrieve user information. By default, Laravel uses a 'web' guard for browser sessions and an 'api' guard for token-based API requests.

Result

You understand that guards are the mechanism Laravel uses to check if a user is logged in and who that user is.

Understanding guards as the core of Laravel's authentication system helps you see how user identity is managed consistently across your app.

2

FoundationDefault Guards in Laravel

3

IntermediateCustomizing Guards for Different Users

4

IntermediateUsing Guards in Middleware and Controllers

5

IntermediateGuard User Providers and Models

6

AdvancedSession vs Token Guards Explained

7

ExpertGuard Internals and Custom Guard Creation

Under the Hood

When a request comes in, Laravel uses the guard specified for that route or default guard. The guard uses its user provider to retrieve user data, then checks credentials or tokens. For session guards, Laravel reads the session cookie and loads the user from session data. For token guards, it validates the token on each request. Guards implement a common interface so Laravel can interact with them uniformly.

Why designed this way?

Laravel designed guards as interchangeable components to support multiple authentication methods cleanly. This modular design allows apps to support web sessions, APIs, and custom methods without mixing logic. It also separates concerns: guards handle authentication, providers handle user data retrieval, making the system flexible and maintainable.

┌───────────────┐
│ HTTP Request  │
└──────┬────────┘
       │
       ▼
┌───────────────┐
│ Guard Layer   │
│ (Session or   │
│  Token check) │
└──────┬────────┘
       │
       ▼
┌───────────────┐
│ User Provider │
│ (Fetch user   │
│  from DB)     │
└──────┬────────┘
       │
       ▼
┌───────────────┐
│ User Model    │
│ (User data)   │
└───────────────┘

Myth Busters - 4 Common Misconceptions

Quick: Do you think the 'auth' middleware always uses the same guard? Commit yes or no.

Common Belief:The 'auth' middleware always uses the default 'web' guard for all routes.

Tap to reveal reality

Quick: Do you think guards store user data permanently? Commit yes or no.

Common Belief:Guards store user data permanently on the server.

Tap to reveal reality

Quick: Do you think you can use the same guard for both web and API authentication without issues? Commit yes or no.

Common Belief:One guard can handle both web sessions and API token authentication seamlessly.

Tap to reveal reality

Quick: Do you think custom guards are only for very rare cases? Commit yes or no.

Common Belief:Custom guards are rarely needed and only for complex apps.

Tap to reveal reality

Expert Zone

1

Guards can be stacked or layered by combining middleware, but the order and guard choice affect authentication flow subtly.

2

The user provider used by a guard can be swapped dynamically at runtime, enabling multi-tenant or context-based authentication.

3

Custom guards can implement caching of user retrieval to optimize performance, but this must be balanced with security concerns.

When NOT to use

Avoid using guards when you need fine-grained authorization; instead, use Laravel policies or gates. Also, for simple apps with one user type, default guards suffice without custom guards. For external OAuth or social login, consider Laravel Socialite instead of custom guards.

Production Patterns

In production, apps often define separate guards for admins, customers, and API users. Middleware groups specify guards per route group. Custom guards integrate with external identity providers. Token guards use JWT or Passport for secure API authentication.

Connections

Middleware

Guards are often used inside middleware to protect routes by checking authentication.

Understanding guards helps you grasp how middleware enforces security by verifying user identity before allowing access.

OAuth 2.0

OAuth 2.0 is an authentication protocol that can be implemented using custom guards or packages in Laravel.

Knowing guards clarifies how Laravel can support OAuth flows by customizing authentication checks.

Security Checkpoints in Physical Buildings

Both guards and physical security checkpoints verify identity before granting access.

Recognizing this parallel helps appreciate the layered security approach in software and real life.

Common Pitfalls

#1Using the default 'web' guard for API routes causing token authentication to fail.

Wrong approach:Route::middleware('auth')->get('/api/data', function () { return 'data'; });

Correct approach:Route::middleware('auth:api')->get('/api/data', function () { return 'data'; });

Root cause:Not specifying the correct guard in middleware leads Laravel to use the wrong authentication method.

#2Assuming guards store user data permanently and not handling logout properly.

Wrong approach:Auth::guard('web')->logout(); // but session not cleared properly

Correct approach:Auth::guard('web')->logout(); session()->invalidate(); session()->regenerateToken();

Root cause:Misunderstanding that logout requires clearing session data, not just calling logout.

#3Defining multiple guards but using the same user provider causing confusion in user retrieval.

Wrong approach:'guards' => ['admin' => ['driver' => 'session', 'provider' => 'users'], 'user' => ['driver' => 'session', 'provider' => 'users']],

Correct approach:'guards' => ['admin' => ['driver' => 'session', 'provider' => 'admins'], 'user' => ['driver' => 'session', 'provider' => 'users']],

Root cause:Not separating user providers for different guards causes user data mix-ups.

Key Takeaways

Authentication guards in Laravel control how users prove their identity for each request, acting as gatekeepers.

Laravel provides default guards for web sessions and API tokens, but you can create custom guards for different user types or methods.

Guards connect to user providers that fetch user data, separating authentication logic from data retrieval.

Choosing the right guard type (session or token) is crucial for security and proper app behavior.

Understanding guards as classes with logic enables deep customization and integration with external authentication systems.