Token management in Laravel - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to generate a new API token for the authenticated user.

Laravel

$token = auth()->user()->[1]('api-token');

Drag options to blanks, or click blank then click option'

AcreateToken

BgenerateToken

CmakeToken

DnewToken

Attempts:

3 left

💡 Hint

Common Mistakes

Using a method name that does not exist like generateToken.

Trying to call token creation on the auth() helper instead of the user.

The createToken method generates a new API token for the user in Laravel.

2fill in blank

medium

Complete the code to revoke the current user's token.

Laravel

auth()->user()->currentAccessToken()->[1]();

Drag options to blanks, or click blank then click option'

Arevoke

Bdelete

Cremove

Dinvalidate

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'revoke' which is not a method on the token model.

Trying to set the token to null instead of deleting.

The delete method removes the current access token from the database, effectively revoking it.

3fill in blank

hard

Fix the error in the code to check if the token has a specific ability.

Laravel

if ($token->[1]('update-posts')) {
    // allow update
}

Drag options to blanks, or click blank then click option'

Acan

BhasAbility

CcheckAbility

Dallows

Attempts:

3 left

💡 Hint

Common Mistakes

Using non-existent methods like hasAbility or checkAbility.

Confusing token abilities with user permissions.

The can method checks if the token has a given ability in Laravel Sanctum.

4fill in blank

hard

Fill both blanks to create a token with specific abilities and retrieve its plain text token.

Laravel

$token = auth()->user()->[1]('api-token', ['create', 'update']);
$plainTextToken = $token->[2];

Drag options to blanks, or click blank then click option'

AcreateToken

BplainTextToken

Ctoken

DgetToken

Attempts:

3 left

💡 Hint

Common Mistakes

Using a method instead of a property for the token string.

Confusing token abilities with user roles.

createToken creates a token with abilities, and plainTextToken gets the token string to send to clients.

5fill in blank

hard

Fill all three blanks to revoke all tokens except the current one for the authenticated user.

Laravel

auth()->user()->tokens()->where('id', '!=', auth()->user()->[1]()->id)->[2]();
$currentToken = auth()->user()->[3]();

Drag options to blanks, or click blank then click option'

AcurrentAccessToken()->id

Bdelete

CcurrentAccessToken

Dtoken

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'token' instead of 'currentAccessToken' to get the current token.

Trying to revoke tokens without filtering out the current one.

This code deletes all tokens except the current one by comparing token IDs, then retrieves the current token.

Practice

1. What is the main purpose of token management in Laravel?

easy

A. To control user access securely using secret tokens

B. To store user passwords in plain text

C. To speed up database queries

D. To create user interface components

Solution

1. Step 1: Understand token management role

   Token management is about controlling access by issuing and verifying tokens.

2. Step 2: Identify correct purpose in Laravel context

   Laravel uses tokens to securely authenticate users without exposing passwords.

3. Final Answer:

   To control user access securely using secret tokens -> Option A

4. Quick Check:

   Token management = secure user access [OK]

Hint: Tokens control access, not UI or passwords [OK]

Common Mistakes:

• Confusing tokens with passwords
• Thinking tokens speed up queries
• Mixing token use with UI design

2. Which Laravel method is used to create a new API token for a user?

easy

A. $user->makeToken()

B. $user->createToken('token-name')

C. $user->generatePassword()

D. $user->newApiKey()

Solution

1. Step 1: Recall Laravel Sanctum token creation method

   Laravel Sanctum uses createToken() to generate tokens for users.

2. Step 2: Match method names with Laravel documentation

   Only createToken() is the correct method; others are invalid or non-existent.

3. Final Answer:

   $user->createToken('token-name') -> Option B

4. Quick Check:

   Token creation method = createToken() [OK]

Hint: Remember: createToken() creates tokens in Laravel [OK]

Common Mistakes:

• Using non-existent methods like makeToken()
• Confusing token creation with password generation
• Using wrong method names

3. Given this code snippet, what will return $user->tokens()->count(); output after creating two tokens?

$user = User::find(1);
$user->createToken('token1');
$user->createToken('token2');
return $user->tokens()->count();

medium

A. 2

B. 1

C. Error

D. 0

Solution

1. Step 1: Understand token creation effect

   Each createToken() call adds one token record linked to the user.

2. Step 2: Count tokens after two creations

   After two calls, the user has two tokens stored, so count() returns 2.

3. Final Answer:

   2 -> Option A

4. Quick Check:

   Two tokens created = count 2 [OK]

Hint: Count tokens after creation equals number created [OK]

Common Mistakes:

• Assuming tokens() returns zero without refresh
• Thinking createToken() replaces old tokens
• Expecting an error due to missing save

4. What is wrong with this code snippet for deleting a user's tokens?

$user = User::find(1);
$user->tokens->delete();

medium

A. User::find(1) returns null, causing error

B. delete() method does not exist in Laravel

C. tokens relationship does not exist by default

D. tokens is a collection, so delete() cannot be called directly

Solution

1. Step 1: Identify tokens property type

   $user->tokens returns a collection, not a query builder.

2. Step 2: Understand collection vs query builder methods

   delete() is a query builder method; collections need each() or query to delete.

3. Final Answer:

   tokens is a collection, so delete() cannot be called directly -> Option D

4. Quick Check:

   Collection.delete() invalid, use query builder [OK]

Hint: Use query builder for delete, not collection [OK]

Common Mistakes:

• Calling delete() on collection directly
• Not checking if user exists
• Assuming delete() is a collection method

5. How can you revoke all tokens for the currently authenticated user except the current token in Laravel Sanctum?

hard

A. $user->currentAccessToken()->delete();

B. $user->tokens()->delete();

C. $user->tokens()->where('id', '!=', $currentTokenId)->delete();

D. $user->revokeTokensExceptCurrent();

Solution

1. Step 1: Understand token revocation requirements

   We want to delete all tokens except the current one, so we filter by token ID.

2. Step 2: Use query builder to delete filtered tokens

   Using where('id', '!=', $currentTokenId) excludes current token, then delete() removes others.

3. Step 3: Check other options for correctness

   $user->tokens()->delete(); deletes all tokens including current; $user->currentAccessToken()->delete(); deletes only current; $user->revokeTokensExceptCurrent(); is not a Laravel method.

4. Final Answer:

   $user->tokens()->where('id', '!=', $currentTokenId)->delete(); -> Option C

5. Quick Check:

   Filter tokens by ID, then delete others [OK]

Hint: Filter tokens by ID to exclude current, then delete [OK]

Common Mistakes:

• Deleting all tokens including current
• Trying to call non-existent methods
• Deleting only current token instead of others