Token management in Laravel - Performance & Optimization

Performance: Token management

MEDIUM IMPACT

Token management affects page load speed and interaction responsiveness by controlling how authentication tokens are stored, validated, and refreshed in the frontend and backend.

Handling user authentication tokens in a Laravel app

Laravel

// Use Laravel Sanctum or Passport with HttpOnly cookies
// Backend manages token refresh automatically

// JavaScript example
fetch('/api/data', { credentials: 'include' });

Using HttpOnly cookies avoids manual token handling and refreshes tokens securely, reducing failed requests and improving responsiveness.

📈 Performance GainReduces failed requests and network overhead, improving INP and user experience.

Handling user authentication tokens in a Laravel app

Laravel

// Storing token in localStorage and sending it with every request manually
// No token refresh logic

// JavaScript example
localStorage.setItem('auth_token', token);
fetch('/api/data', {
  headers: { 'Authorization': 'Bearer ' + localStorage.getItem('auth_token') }
});

Storing tokens in localStorage exposes security risks and causes repeated manual token sending without refresh, leading to stale tokens and failed requests.

📉 Performance CostTriggers multiple failed requests causing delays and blocks user interactions (INP impact).

Performance Comparison

Pattern	DOM Operations	Reflows	Paint Cost	Verdict
Manual token handling with localStorage	Minimal	0	Low	[X] Bad
HttpOnly cookie token management with Laravel Sanctum	Minimal	0	Low	[OK] Good

Rendering Pipeline

Token management affects the network request stage and interaction responsiveness by controlling when and how tokens are sent and refreshed, impacting the browser's ability to quickly paint updated UI after user actions.

→Network

→JavaScript Execution

→Composite

⚠️ BottleneckNetwork delays caused by failed or repeated token validation requests

Core Web Vital Affected

INP

Token management affects page load speed and interaction responsiveness by controlling how authentication tokens are stored, validated, and refreshed in the frontend and backend.

Optimization Tips

1Avoid storing tokens in localStorage to reduce security risks and failed requests.

2Use HttpOnly cookies for automatic and secure token management.

3Implement automatic token refresh on the backend to minimize network delays.

Performance Quiz - 3 Questions

Which token storage method reduces the risk of token theft and improves interaction responsiveness?

A Storing tokens in localStorage

B Storing tokens in HttpOnly cookies

C Storing tokens in sessionStorage

D Embedding tokens in HTML meta tags

DevTools: Network

How to check: Open DevTools > Network tab, filter XHR/fetch requests, check Authorization headers and response status codes for token errors or refresh calls.

What to look for: Look for repeated 401 Unauthorized responses or multiple token refresh requests indicating inefficient token management.

Practice

1. What is the main purpose of token management in Laravel?

easy

A. To control user access securely using secret tokens

B. To store user passwords in plain text

C. To speed up database queries

D. To create user interface components

Solution

1. Step 1: Understand token management role

   Token management is about controlling access by issuing and verifying tokens.

2. Step 2: Identify correct purpose in Laravel context

   Laravel uses tokens to securely authenticate users without exposing passwords.

3. Final Answer:

   To control user access securely using secret tokens -> Option A

4. Quick Check:

   Token management = secure user access [OK]

Hint: Tokens control access, not UI or passwords [OK]

Common Mistakes:

• Confusing tokens with passwords
• Thinking tokens speed up queries
• Mixing token use with UI design

2. Which Laravel method is used to create a new API token for a user?

easy

A. $user->makeToken()

B. $user->createToken('token-name')

C. $user->generatePassword()

D. $user->newApiKey()

Solution

1. Step 1: Recall Laravel Sanctum token creation method

   Laravel Sanctum uses createToken() to generate tokens for users.

2. Step 2: Match method names with Laravel documentation

   Only createToken() is the correct method; others are invalid or non-existent.

3. Final Answer:

   $user->createToken('token-name') -> Option B

4. Quick Check:

   Token creation method = createToken() [OK]

Hint: Remember: createToken() creates tokens in Laravel [OK]

Common Mistakes:

• Using non-existent methods like makeToken()
• Confusing token creation with password generation
• Using wrong method names

3. Given this code snippet, what will return $user->tokens()->count(); output after creating two tokens?

$user = User::find(1);
$user->createToken('token1');
$user->createToken('token2');
return $user->tokens()->count();

medium

A. 2

B. 1

C. Error

D. 0

Solution

1. Step 1: Understand token creation effect

   Each createToken() call adds one token record linked to the user.

2. Step 2: Count tokens after two creations

   After two calls, the user has two tokens stored, so count() returns 2.

3. Final Answer:

   2 -> Option A

4. Quick Check:

   Two tokens created = count 2 [OK]

Hint: Count tokens after creation equals number created [OK]

Common Mistakes:

• Assuming tokens() returns zero without refresh
• Thinking createToken() replaces old tokens
• Expecting an error due to missing save

4. What is wrong with this code snippet for deleting a user's tokens?

$user = User::find(1);
$user->tokens->delete();

medium

A. User::find(1) returns null, causing error

B. delete() method does not exist in Laravel

C. tokens relationship does not exist by default

D. tokens is a collection, so delete() cannot be called directly

Solution

1. Step 1: Identify tokens property type

   $user->tokens returns a collection, not a query builder.

2. Step 2: Understand collection vs query builder methods

   delete() is a query builder method; collections need each() or query to delete.

3. Final Answer:

   tokens is a collection, so delete() cannot be called directly -> Option D

4. Quick Check:

   Collection.delete() invalid, use query builder [OK]

Hint: Use query builder for delete, not collection [OK]

Common Mistakes:

• Calling delete() on collection directly
• Not checking if user exists
• Assuming delete() is a collection method

5. How can you revoke all tokens for the currently authenticated user except the current token in Laravel Sanctum?

hard

A. $user->currentAccessToken()->delete();

B. $user->tokens()->delete();

C. $user->tokens()->where('id', '!=', $currentTokenId)->delete();

D. $user->revokeTokensExceptCurrent();

Solution

1. Step 1: Understand token revocation requirements

   We want to delete all tokens except the current one, so we filter by token ID.

2. Step 2: Use query builder to delete filtered tokens

   Using where('id', '!=', $currentTokenId) excludes current token, then delete() removes others.

3. Step 3: Check other options for correctness

   $user->tokens()->delete(); deletes all tokens including current; $user->currentAccessToken()->delete(); deletes only current; $user->revokeTokensExceptCurrent(); is not a Laravel method.

4. Final Answer:

   $user->tokens()->where('id', '!=', $currentTokenId)->delete(); -> Option C

5. Quick Check:

   Filter tokens by ID, then delete others [OK]

Hint: Filter tokens by ID to exclude current, then delete [OK]

Common Mistakes:

• Deleting all tokens including current
• Trying to call non-existent methods
• Deleting only current token instead of others